Fail over to the second region, which has never served full traffic
A service runs active-passive across two regions. The primary region is degraded — elevated errors, not a clean failure. The passive region is provisioned at 40% of the primary's capacity because "it is only a standby". The database replicates asynchronously with lag typically under two seconds. You have to decide whether to fail over.
The fix that looks right
Shifting traffic to the secondary first, on the reasoning that getting users onto a healthy region is the priority and the database can be promoted immediately after. For the seconds or minutes between those two actions, the secondary is serving reads from a lagging replica and either failing writes or — worse, if the application is configured to write to whichever database it can reach — writing into a region whose data then diverges from the primary that is still accepting writes. The outage becomes a data reconciliation project. Traffic follows the data position; the fence and the promotion come first.