Everything in one building
Load balancer, two app servers, database — all correct, all in Availability Zone A. Two app servers means the design survives an instance failure, and the runbook says the system is redundant.
It survives a server dying. It does not survive the zone dying, and a zone is a real place with real power and real network.
Boundaries, outermost first: Region: Load balancer (spans both zones) Zone A: App server (zone A; FAILED: offline), Primary (zone A; FAILED: offline) Zone B: an empty slot for the zone B compute, an empty slot for the zone B data Connections: Load balancer calls App server (step 1) Load balancer calls zone B compute — both zones (step 2) App server calls Primary zone B compute calls Primary Primary publishes to zone B data — replication · promote on failure