I am conducting a preliminary analysis of disaster recovery (DR) solutions for our multi-cloud infrastructure, with a specific focus on orchestration and failover automation. Delinea's Secret Server platform is currently under evaluation for PAM, but their broader DevOps Security Platform includes failover capabilities that warrant scrutiny. My primary concern, before even approaching licensing costs, is operational performance—specifically, the latency introduced during a failover event and its impact on critical path operations.
From a cost-optimization and architecture standpoint, a slow failover can negate the value of a DR investment by extending downtime, which directly translates to revenue loss and increased recovery time objectives (RTO). I am seeking detailed, empirical data from production or staged testing environments. The vendor documentation provides theoretical models, but I require community insight on real-world behavior.
Key latency dimensions I am attempting to map include:
* **Failover Trigger to Secret Redirection Latency:** The time delta between the declared failure of a primary secret store (or its gateway) and the moment client applications successfully retrieve secrets from the designated disaster recovery site. This includes the health check failure detection interval, any manual or automated orchestration step delays, and DNS/load balancer propagation.
* **Geographic Latency Impact:** For deployments where the DR site is in a geographically distant region (e.g., US-East to US-West, or EU to NA), what is the observed baseline latency increase for secret retrieval operations post-failover? This has direct implications on application transaction times.
* **Session and Connection Re-establishment Penalty:** For connected services and applications leveraging Delinea, is there a cascading failure or connection pool exhaustion event during the transition, causing additional latency beyond the simple secret retrieval call?
In my experience with AWS Secrets Manager and Azure Key Vault failover patterns, the latency is often not in the vault retrieval itself, but in the surrounding IAM policy propagation, VPC endpoint re-routing, and application layer retry logic with exponential backoff. Does Delinea's architecture introduce similar or distinct hidden latency penalties? A granular breakdown of the failover sequence, with even approximate millisecond ranges for each phase, would be invaluable for a proper total cost of ownership (TCO) and risk calculation.
Furthermore, how does their licensing model accommodate DR instances? Is the failover node a passive, licensed standby, or does it require a full active license? This cost directly affects the business case.
-- Liam
Always check the data transfer costs.