How the Survival Score is calculated

The Survival Score rates how your stack would cope if us-east-1 went down. It starts at 100, loses points for your region setup and for global control planes your services rely on, gains a few for failover you can run without the console, and ends up between 0 and 100.

The same answers always produce the same score. The tables below are generated from the rules the quiz runs, so if a rule changes, this page changes with it.

Your two region answers alone can take the score down to 65.
The six control-plane dependencies cost up to 46 points between them, and a DynamoDB line adds 10 more when your primary region is us-east-1.
Two yes/no questions can win back up to 25 points of penalties, plus 8 in bonuses. “Don't know” counts as no.
Tiers: Bunker 85–100, Sandbagged 65–84, Exposed 40–64, Toast 0–39.
Lifecycle Risk, the second score, is calculated separately and covers services AWS is closing down.

What it measures

The score covers one failure: us-east-1 is impaired and your stack has to keep serving or move. The quiz asks for your primary region, how far your second region goes, and two questions about failover. The services you tick decide which control planes count against you.

It leaves out a lot on purpose:

Multi-AZ. Availability Zones sit inside one Region, so spreading across them earns nothing here.
Cost, latency and throughput.
Your written RTO and RPO targets. The score reads your answers about how failover actually works.
Security posture and compliance scope.
Your real AWS resources. The quiz never asks for credentials, account IDs or IaC, and nothing connects to your account.
Whether AWS is retiring a service you use. Lifecycle Risk covers that.

Region posture

Round 2 asks two region questions. Both answers count, and they add together.

Primary region

Answer	Points
us-east-1	−20
Any other region	0

A us-east-1 primary is the largest single deduction. It also turns on the DynamoDB line described further down.

Multi-region posture

Answer	Points
Single region	−15
Backups in another region	−8
Warm standby	0
Active-active	+10

Backups in a second Region still need a restore before anything serves traffic. Warm standby is neutral, and active-active is the only answer that adds points. A us-east-1 primary with a single Region leaves 65 before any dependency is counted.

Hidden dependencies

Some AWS control planes are global or run only in us-east-1, so they stay put when your workload moves to another Region. A dependency counts only if you ticked a service that relies on it. It counts once, however many of your services rely on it.

Dependency	Points	If mitigated
Global STS endpoint From AWS STS (role assumption)	−12	−2
Route 53 control plane From Amazon Route 53	−12	−3
IAM control plane From AWS IAM	−6	No mitigation
Console sign-in and Identity Center From IAM Identity Center (SSO) and AWS Organizations	−8	−2
CloudFront control plane From Amazon CloudFront, Lambda@Edge and AWS Certificate Manager	−6	No mitigation
Billing and Cost Explorer From AWS Cost Explorer / Billing and AWS Marketplace subscriptions	−2	No mitigation

Global STS endpoint

The global STS endpoint sts.amazonaws.com was historically served only from us-east-1. Calls from inside default AWS Regions using Amazon DNS are now served locally, but calls from opt-in Regions, on-premises, laptops or CI outside AWS still go to us-east-1. Legacy SDKs (CLI v1, boto3, JS v2, Java 1.x) also still default to the global endpoint.

What helps: Set AWS_STS_REGIONAL_ENDPOINTS=regional (or the SDK equivalent) everywhere, including CI and laptops; test it.

AWS source

Route 53 control plane

Route 53's control plane (record and hosted-zone changes) is hosted in us-east-1; public zones can opt into an accelerated-recovery standby in us-west-2 that takes about an hour to kick in. Resolution keeps working, but a failover that relies on a human editing records may be impossible.

What helps: Use health-check-based failover records or Application Recovery Controller routing controls, pre-created, so no record edits are needed during an incident.

AWS source

IAM control plane

IAM is a global service whose control plane is in us-east-1. Existing credentials keep working; creating or changing roles/policies may not.

What helps: Pre-provision every role and policy the DR path needs; never create IAM resources inside a runbook.

AWS source

Console sign-in and Identity Center

The global sign-in endpoint (signin.aws.amazon.com) and the Organizations control plane are in us-east-1. During the Oct-2025 event, IAM users and IAM Identity Center instances homed in us-east-1 could not sign in to fix things.

What helps: Bookmark regional console and sign-in URLs, replicate Identity Center to a second Region, keep break-glass CLI credentials outside AWS, and make runbooks executable without the console.

AWS source

CloudFront control plane

CloudFront configuration, invalidations, ACM certificates for CloudFront, Lambda@Edge and WAF for CloudFront are us-east-1 constructs. Edge serving continues, changes do not.

What helps: Avoid needing config changes during failover (origin failover groups, pre-provisioned origins).

AWS source

Billing and Cost Explorer

Cost Explorer, Cost and Usage Reports, Data Exports, the Marketplace Catalog and Entitlement APIs and Route 53 domain registration are only offered in us-east-1. There is no runtime impact, but Marketplace-licensed software may fail to activate.

What helps: Know it; no action beyond awareness.

AWS source

The us-east-1 DynamoDB blast radius

This line costs 10 points and has no mitigation. It applies only when your primary region is us-east-1 and you ticked at least one of Amazon EC2, AWS Lambda, Amazon ECS, Amazon EKS, Amazon DynamoDB, Amazon Redshift, Elastic Load Balancing (ALB/NLB) or Amazon Connect. Those are the services the October 2025 event reached.

On 19–20 Oct 2025 a race condition in DynamoDB's DNS automation left the us-east-1 endpoint with an empty DNS record. Over about 14.5 hours it cascaded into EC2 instance launches, Lambda event-source polling, Network Load Balancer health checks, ECS/EKS/Fargate launches, Redshift, Connect and DynamoDB global table replication.

What helps: Run the primary somewhere other than us-east-1, or at minimum keep a tested warm standby elsewhere.

AWS event summary

The two yes/no questions

Each “yes” softens one or two dependency penalties and adds a small bonus. A softened penalty stays on the board, because the control plane is still in us-east-1. “Don't know” scores the same as “no”: if nobody can point to the config or the last drill, the quiz doesn't give the points.

If us-east-1 died right now, could you fail over without a human logging into the console or changing Route 53 records by hand?

With a yes	Points
Route 53 control plane penalty	−12 becomes −3
Console sign-in and Identity Center penalty	−8 becomes −2
Bonus	+5

Worth up to 20 points if your stack includes both dependencies.

Do your SDKs and CLIs use STS regional endpoints (not sts.amazonaws.com)?

With a yes	Points
Global STS endpoint penalty	−12 becomes −2
Bonus	+3

Worth up to 13 points if your stack includes that dependency.

The four tiers

The final score lands in one of four bands.

Score	Tier	What it means
85–100	Bunker	You'd sleep through it. Regional endpoints, automated failover and no us-east-1 habit. Few stacks get here.
65–84	Sandbagged	You'd be wet but alive. A few global control planes could bite during the failover you'd actually need.
40–64	Exposed	Multi-AZ is not multi-region. Your runbook has a human in the console and a global STS endpoint in it.
0–39	Toast	Same blast radius as Slack in Oct 2025. Everything routes through us-east-1, including your ability to fix it.

Worked example

A stack that uses AWS STS (role assumption), Amazon Route 53, AWS IAM, IAM Identity Center (SSO), Amazon CloudFront, AWS Cost Explorer / Billing and Amazon DynamoDB. The primary is in us-east-1 with a warm standby in a second Region, and the team answered yes to both questions.

Line	Points	Total
Start		100
Primary region is us-east-1	−20	80
Multi-region posture: warm standby	0	80
Global STS endpoint (mitigated)	−2	78
Route 53 control plane (mitigated)	−3	75
IAM control plane	−6	69
Console sign-in and Identity Center (mitigated)	−2	67
CloudFront control plane	−6	61
Billing and Cost Explorer	−2	59
us-east-1 DynamoDB blast radius	−10	49
Bonus: failover without the console	+5	54
Bonus: SDKs on regional STS endpoints	+3	57

57: Exposed, 8 points short of Sandbagged. Of the 51 points this stack loses, 44 come from lines no answer can soften: the us-east-1 primary, IAM control plane, CloudFront control plane, Billing and Cost Explorer, and us-east-1 DynamoDB blast radius.

The same services with one answer changed:

Primary in the EU and active-active: 97, Bunker. The us-east-1 and DynamoDB lines drop out and the posture line turns positive.
“Don't know” on the failover question: 37, Toast. Route 53 and console sign-in go back to their full penalties, and the failover bonus goes too.

Lifecycle Risk (0–100)

Lifecycle Risk is a separate score for how much of your stack AWS is closing down. Each service you ticked adds points, the total is capped at 100, and higher is worse.

Service you ticked	Points
In sunset (end date announced)	30
Retired (end date passed)	30
In maintenance (closed to new customers, no end date)	15
Active, with deprecated features inside it	5

Score	Tier	Headline
0	Evergreen	Nothing on the chopping block.
1–20	Pruning needed	A deprecated feature or two. Plan a sprint.
21–50	Deprecation debt	At least one service AWS has already frozen.
51–100	Borrowed time	You are building on services that are closed to new customers.

One service in maintenance plus one active service with a deprecated feature: 20, Pruning needed.
Two services in sunset: 60, Borrowed time.
Four services in sunset: 100, Borrowed time.

Every lifecycle claim in the quiz links to an official AWS source. Services we couldn't source never appear in Round 1 and carry no points. The retirement waves on the About page list them all.

Where these numbers come from

The quiz and this page read the same rules, so the score on your result card and the tables here can't disagree. Shared result pages keep each score as it was played.

The AWS facts link to AWS sources. The point values are our own judgement, published so you can check a score you don't believe. This is an independent project, and AWS hasn't reviewed it.

Short answers

Is the Survival Score a model?: No. It is arithmetic on your answers, applied in a fixed order and clamped to 0–100.
Can a stack score 100?: Yes. A primary outside us-east-1 with warm standby and no dependency lines already scores 100.
Why does billing cost only 2?: Billing and Cost Explorer have no runtime impact. The points cover Marketplace-licensed software that may fail to activate.
Does the DynamoDB line apply if I don't use DynamoDB?: It applies if your primary is us-east-1 and you ticked any of Amazon EC2, AWS Lambda, Amazon ECS, Amazon EKS, Amazon DynamoDB, Amazon Redshift, Elastic Load Balancing (ALB/NLB) or Amazon Connect.

Sources

Play the quiz (3 min)