Skip to content

AWS

Read original ↗

S&P Global's innovative disaster recovery strategy using Amazon FSx for NetApp ONTAP snapshots

Summary

S&P Global Market Intelligence implemented a two-phase disaster recovery strategy for their Capital IQ financial data platform using Amazon FSx for NetApp ONTAP. The architecture uses SnapMirror for 15-minute-interval cross-region replication (US-East-1 → US-West-2) and FlexClone technology to achieve sub-15-minute read-only failover from pre-provisioned snapshot-based clones. Phase 1 delivers immediate read-only access; Phase 2 breaks the SnapMirror relationship and reverses replication for full read-write recovery. The solution maintains data consistency for global financial operations while optimizing cross-region replication costs via storage-efficient clones that share data blocks with the parent volume.

Key takeaways

  1. Two-phase DR strategy balances immediacy with completeness: Phase 1 (read-only via FlexClone from SnapMirror snapshot) provides sub-15-minute business continuity; Phase 2 (full SnapMirror break + reverse) delivers complete read-write capability when needed. This separates the "access critical data" problem from the "resume full operations" problem.

  2. FlexClone creates volumes in under 2 minutes because it uses copy-on-write semantics — the clone shares data blocks with the parent volume and only allocates new blocks when writes diverge. This is the storage-level equivalent of copy-on-write forking — near-zero additional storage consumption for the clone at creation time.

  3. FlexClone operates independently from SnapMirror replication: the clone is created from an existing SnapMirror snapshot, not from the active mirror relationship. This means ongoing replication is not interrupted by DR testing or actual failover to read-only mode — a critical operational property for financial services where data protection cannot have gaps.

  4. SnapMirror replication at 15-minute intervals creates the RPO envelope: during lower-activity periods RPO can be a few minutes; during high-transaction volumes it approaches the 15-minute window. The variable RPO is acknowledged explicitly — a realistic production trade-off disclosure.

  5. Full read-write recovery follows a strict 6-step orchestration: stop writes → final SnapMirror update → break mirror → reverse replication direction → fail over SQL Server → resume operations. The ordered sequence ensures zero data loss during the Phase 2 transition because the final update captures all remaining changes before the break.

  6. Four-node geo-distributed Windows Server Failover Cluster (WSFC) spans two AWS Regions, with two FSx for NetApp ONTAP file systems (one per region) as the storage layer. The compute (WSFC) and storage (ONTAP) layers are independently managed but coordinated through the DR orchestration.

  7. Pre-provisioned read-only instances reduce failover to an application cutover: because the FlexClone volume is refreshed daily via scheduled automation, initiating failover is primarily a traffic redirect — not a rebuild. This transforms DR from a "build on demand" exercise into a "switch on demand" operation.

  8. Financial services regulatory context: the solution meets stringent business continuity requirements for S&P Global's 160-year-old financial intelligence business serving global clients who rely on timely and accurate data for decision-making.

Architecture

  • Compute layer: 4-node geo-distributed WSFC spanning US-East-1 and US-West-2
  • Storage layer: Two Amazon FSx for NetApp ONTAP file systems (primary in US-East-1, DR in US-West-2)
  • Data replication: SnapMirror at 15-minute intervals (primary → DR)
  • Rapid recovery: FlexClone volumes from SnapMirror snapshots in the DR region
  • Encryption: Data at rest via AWS KMS; data in transit via AES-256-GCM (SnapMirror) and optionally SMB Kerberos / NFS Kerberos

Operational numbers

Metric Value
FlexClone creation time < 2 minutes
Read-only failover target ≤ 15 minutes
SnapMirror replication interval 15 minutes
RPO (low activity) A few minutes
RPO (high activity) Up to 15 minutes
Additional storage for clone Minimal (shared data blocks via COW)

DR tier classification

This architecture implements a hybrid pilot-light / warm-standby shape on the DR ladder: - The daily-refreshed FlexClone is effectively a warm standby for read-only access (pre-provisioned, ready to serve immediately) - Full read-write capability requires the SnapMirror break sequence, which is closer to pilot light (data replicated, compute available, but needs orchestrated activation)

Caveats

  • Customer case study genre — no p99 latency numbers, no throughput metrics, no cost breakdown disclosed.
  • The "sub-15-minute" target is a design goal validated by the < 2-minute FlexClone creation; end-to-end failover includes application traffic redirect time which is not quantified.
  • The daily FlexClone refresh schedule means the read-only instance may be up to 24 hours stale relative to the latest SnapMirror snapshot (though more frequent refreshes are possible).
  • No discussion of the full read-write recovery RTO — only the read-only phase has a stated time target.
  • Partner-marketing component (co-written with S&P Global's Director of Engineering) but sufficient architectural depth to ingest.

Source

Last updated · 569 distilled / 1,714 read