Lesson learned: If your recovery plan requires calling any API in the dead region — to detach an IP, describe a route table, launch an instance, read an S3 object, or decrypt a volume — it will fail when you need it most.

Every dependency on the primary region is a dependency on the thing that just broke.