When organizations reach a certain level of cloud maturity, infrastructure as code goes from a luxury to a necessity. AWS CloudFormation is the central tool for hundreds of thousands of teams managing AWS resources declaratively. However, custom resources are both a blessing and a challenge: they allow extending CloudFormation to integrate third-party APIs, execute complex initialization logic, or perform compliance checks, but they lack native support for multi-region deployments. In this article, we explore why this gap is critical and how an active-active architecture with distributed locking can solve it, leveraging services like DynamoDB Global Tables and Application Recovery Controller.
CloudFormation custom resources work by sending lifecycle events (create, update, or delete) to a Lambda function, usually through an SNS topic. CloudFormation waits for a response with a presigned URL to decide whether to continue or roll back the stack. This mechanism is powerful, but when running across multiple regions simultaneously, serious problems arise: no native fan-out mechanism, risk of duplicate execution, no distributed locking, and no automatic failover. The responsibility for idempotency falls entirely on the developer. Until now, teams were forced to accept the risk of a single region or build complex bespoke solutions.
At Q2BSTUDIO, as a company specialized in custom software and cloud technology, we have seen how this gap impacts mission-critical projects. That is why we propose an active-active architecture based on four principles: simultaneous processing in both regions, prevention of duplicate execution via distributed locking with DynamoDB Global Tables, idempotency through state tracking, and fully automated failover with Amazon Application Recovery Controller. This solution eliminates single points of failure without falling into the duplication issues of naive approaches.
The flow starts when a CloudFormation stack in a customer region initiates a lifecycle event. That event is published to a local SNS topic, which has cross-region subscriptions to two SQS queues in the primary and secondary infrastructure regions (e.g., us-east-1 and us-west-2). Both queues receive the event at the same time, establishing the active-active model. The primary Lambda function processes immediately: it checks the DynamoDB global table for an existing lock, acquires it via a conditional write, executes business logic, and sends the response. Meanwhile, the secondary queue has a configured delay (e.g., via a Delay Queue or Visibility Timeout) that gives the primary time to complete. If the primary fails, the secondary takes over when the delay expires.
DynamoDB Global Tables acts as the coordination brain: it maintains lock state (which region holds the lock), idempotency records, and the full state of each event. Bidirectional replication ensures both regions have the latest view, supporting network partitions or regional degradation. Amazon CloudWatch monitors queue depth and Lambda health, triggering alarms that activate ARC to automatically fail over to the secondary region without manual intervention.
For enterprises needing to meet strict disaster recovery objectives (RTO/RPO), data residency mandates, or low latency across geographies, this architecture provides a solid foundation. Moreover, it naturally integrates services like SNS, SQS, Lambda, and DynamoDB, all pillars of the AWS cloud. At Q2BSTUDIO, we combine this technical robustness with our expertise in Artificial Intelligence, cybersecurity, and Business Intelligence to deliver complete solutions. For instance, AI agents can analyze CloudWatch logs to predict failures before they occur, while security policies are enforced via custom checks in CloudFormation resources. Likewise, using Power BI to visualize the status of multi-region stacks allows teams to make informed decisions.
Building multi-region resilience for CloudFormation custom resources is not an optional extra: it is a requirement for workloads that cannot afford downtime. With the described architecture, organizations can scale their global operations without sacrificing correctness or automation. If your company is ready to take its infrastructure to the next level, at Q2BSTUDIO we help design and implement these custom solutions, integrating cloud AWS/Azure, AI, cybersecurity, and BI coherently and efficiently.
