Putting Writes on the Global Writer Endpoint at Deployment, Not During the Outage

The endpoint decision trades flexibility for failover semantics. The global writer endpoint always resolves to the current primary — including after a switchover or managed failover — and Aurora applies additional write safeguards to traffic through it during fencing windows. Cluster endpoints don't follow: a promoted secondary's writer endpoint is its old reader endpoint minus -ro (my-global.cluster-ro-… becomes my-global.cluster-…), so applications bound to cluster endpoints need config changes mid-incident. Reads belong on each Region's own reader endpoint for local latency; RDS Proxy users must repoint to the new primary's proxy endpoint after promotion.

Applications hardcode the primary Region's cluster endpoint. During failover, writes keep aiming at a dead endpoint — or worse, at the recovered but diverged old primary — until someone edits config under pressure. Separately, DNS caches with default TTLs hold the stale global-endpoint record after promotion, and writes land on the fenced Region during the window; AWS's own guidance is that fencing is best-effort, not a guarantee.