← Back to Services

RDS

Priority Tier 2 Domain 1: Design Secure Architectures Domain 2: Design Resilient Architectures Domain 3: Design High-Performing Architectures Domain 4: Design Cost-Optimized Architectures

Amazon Relational Database Service (RDS) is a fully managed database service that makes it easy to set up, operate, and scale a relational database in the cloud (source_page 1, 3). AWS handles administrative tasks like hardware provisioning, database setup, patching, and backups, allowing users to focus on applications (source_page 1, 2, 3). It supports multiple popular database engines, including Amazon Aurora, and offers high availability, durability, and scalability features (source_page 1, 2, 3).

Learning Objectives

Introduction to Amazon RDS

Amazon Relational Database Service (RDS) simplifies relational database management in the cloud, offloading administrative burdens to AWS.

Amazon Relational Database Service (RDS) is a managed database service that makes it easy to set up, operate, and scale a relational database in the cloud. AWS handles the administrative tasks, allowing you to focus on your applications. RDS is a fully managed database service that automates database administration tasks such as backups, patching, upgrades, and replication.
RDS automates time-consuming database management tasks like hardware provisioning, database setup, patching, and backups. It provides high availability, durability, and scalability for relational databases. The aim of RDS is to lower the Total Cost of Ownership (TCO) by offloading routine database tasks, enabling you to focus on your core business. It leverages the maturity of AWS operations in high availability and cross-region replication across multiple data centers.
Technical Specs: 99.95% availability for highly available applications
With RDS, AWS is responsible for automated backups/snapshots, point-in-time recovery, patching/upgrades, monitoring/alerts, and seamless integration with IAM, KMS, and CloudWatch. This leads to higher availability, less operational overhead, and better scalability compared to self-managed databases on EC2, where users are responsible for provisioning hardware, configuring OS, installing/setting up DB and clustering, designing backup strategy, patching, upgrades, and dealing with failures.
Standard RDS instances do not provide direct SSH access to the underlying operating system. If SSH is required, RDS is not the solution.
While RDS offers a free tier for certain instance types and configurations, advanced features like Multi-AZ deployments and Read Replicas incur additional costs. Demo instances should be deprovisioned promptly to avoid ongoing charges. Aurora instances do not offer a free tier.

Supported Database Engines

Amazon RDS supports a variety of commercial, open-source, and cloud-native database engines.

RDS simplifies the deployment and management of several popular database engines.

Commercial Engines

RDS supports widely used commercial relational database engines, offering different editions.
Oracle: Enterprise, Standard, Standard Edition One, Standard Edition 2
Microsoft SQL Server: Express, Web, Standard and Enterprise

Open Source Engines

RDS provides support for popular open-source relational databases.
MariaDB: None
PostgreSQL: None
MySQL: None
IBM DB2: Available with Standard Create option

Cloud Native Engines (Amazon Aurora)

Amazon Aurora is a proprietary, cloud-native relational database designed by Amazon for high performance and availability, compatible with MySQL and PostgreSQL.
Compatibility: MySQL 5.6, MySQL 5.7, PostgreSQL compatible
Performance: Up to 5x the throughput of MySQL, 3x the throughput of PostgreSQL
Free Tier: Does not have a free tier
Instance Size Options: Limited to “Production” and “Dev/Test” templates

RDS Custom for Oracle/SQL Server

RDS Custom is designed for workloads requiring deeper control over the database server host and operating system, allowing for custom patches, special software settings, and third-party applications that need privileged access. AWS manages infrastructure, hardware, failover, and backups, while the customer handles OS and database customization.
Supported Engines: Oracle, SQL Server
High Availability: Needs to be set up in multi-AZ configuration for high availability.
Use Cases:
  • Legacy or highly customized databases
  • Applications requiring privileged OS access

Database Instance Configuration

When creating an RDS database instance, users can choose between simplified or granular configuration options and define various parameters.

RDS offers flexible configuration options to tailor database instances to specific workload requirements.

Database Creation Options

Users can choose between a simplified setup with defaults or a granular approach for fine-tuning.
Easy Create: A simplified setup that uses sensible default templates, offering fewer customization options. Ideal for quick deployments or less complex needs.
Standard Create: Provides granular control over nearly every database parameter, allowing for detailed customization and fine-tuning.

Basic Settings (Standard Create)

Fundamental parameters required for identifying and accessing the database instance.
DB Instance Identifier: A unique name for your database instance (e.g., cs-demo-database).
Master Username: The primary user for connecting to the database (defaults vary by engine, e.g., postgres for PostgreSQL).
Credential Management: Choose to self-manage passwords (either auto-generated or custom) or leverage AWS Secrets Manager for secure storage and automatic rotation.
EC2 Connection: Optionally configure an EC2 instance to connect directly to your RDS database, typically for hosting applications.

General Settings (Standard Create)

Broad configuration aspects that affect the database's security, recovery, and network placement.
Encryption: Enabled by default and cannot be disabled post-creation.
VPC: Defaults to the “Default VPC” and cannot be edited later.
Option Group: Controls various database features; defaults to single-AZ.
Subnet Group: Defines the subnets your database can reside in.
Automatic Backup: Enabled by default, crucial for recovery.
VPC Security Group: Controls network access to your database.

Detailed Configuration Options (Standard Create)

Granular options for customizing engine behavior, templates, availability, instance resources, and connectivity.
Engine Version and Extended Support: Select specific versions of your chosen database engine and enable RDS Extended Support if needed for older versions.
Database Templates: Production (optimized for production workloads), Dev/Test (suitable for development and testing environments), Free Tier (limited to single-AZ instances, suitable for exploring RDS features without incurring significant costs). Aurora instances are limited to “Production” and “Dev/Test” templates.
Availability and Durability: Single-AZ Database Instance (basic availability), Multi-AZ Database (creates a synchronous standby replica in a different Availability Zone for high availability, standby is not directly accessible for read/write operations), Multi-AZ Cluster with Readable Endpoints (Aurora Only: offers multiple readable endpoints for better read scalability and failover).
Instance Configuration - Instance Class: Determines the CPU, memory, and network performance (e.g., m5.large).
Instance Configuration - Storage Type: Typically SSD GP3 EBS volumes.
Instance Configuration - Allocated Storage: The initial size of your database storage.
Instance Configuration - IOPS and Throughput: Configurable for performance-critical workloads.
Connectivity - Network Type: Choose between IPv4 and Dual-stack (IPv4 and IPv6).
Connectivity - Virtual Private Cloud (VPC): Select or create a VPC for your database.
Connectivity - DB Subnet Group: Ensure your database is placed in appropriate subnets.
Connectivity - Public Access: AWS strongly recommends setting this to “No”. Databases should be in private subnets, with access controlled by security groups.
RDS Proxy: Recommended for serverless applications (like AWS Lambda) to manage database connections efficiently, preventing connection exhaustion and improving application stability by acting as a connection pool.

Other Settings

Additional configurable parameters for database functionality and monitoring.
Database Port: Default port varies by engine (e.g., 5432 for PostgreSQL).
Authentication: Options include password authentication, IAM database authentication, and Kerberos authentication.
Monitoring: Standard monitoring is enabled by default. Enhanced Monitoring provides more granular metrics. Data retention can be configured from 7 days up to 24 months.
Log Export: Enable export of database logs to CloudWatch Logs for analysis.
Backup Settings: Automated backups are enabled by default with a configurable backup window and cross-region replication options for disaster recovery.
Encryption: Enabled by default for data at rest and in transit.
Deletion Protection: A crucial safety feature to prevent accidental deletion of production databases. It must be disabled before the instance can be deleted.
DB Option Group: Optional functionality you would like to enable on the Database Instance.
DB Parameter Group: A group of parameters which define the configuration of the Database Instance.

High Availability and Durability

RDS provides various options to ensure high availability and durability of your database instances, primarily through Multi-AZ deployments.

A basic deployment option with a single database instance in one Availability Zone, offering basic availability. This is often suitable for Dev/Test or Free Tier deployments.
This configuration creates a synchronous standby replica of the primary database instance in a different Availability Zone for high availability. The standby is not directly accessible for read/write operations. Data is synchronously replicated, ensuring every transaction is committed to both instances before acknowledgment, providing data consistency and zero data loss during failover. This protects against instance failure, storage failure, and Availability Zone outages.
Offers one primary instance with two readable standby instances in separate AZs. This configuration is available for MySQL and PostgreSQL, allowing for better read scalability and failover by directing read traffic to the standby copies.
Automatic failover occurs under circumstances such as an Availability Zone outage, primary DB instance failure, DB instance class change, operating system software patching, or manual failover initiated by 'Reboot with failover'. When a failover occurs, RDS changes the DNS record of the endpoint to point to the standby, which is promoted to become the new primary. The endpoint for your DB Instance remains the same, allowing applications to resume database operations without manual administrative intervention. The newly promoted primary remains primary; the failed instance is recovered and becomes the new standby.
Technical Specs: Failover typically takes a short period. Application latency may occur during the transition. Time to Live (TTL) properties for DNS caching should be respected. Can take 1-2 minutes.
A Single-AZ instance can be upgraded to a Multi-AZ deployment through the 'Modify' option in the AWS Management Console. This is a zero-downtime operation, during which the RDS database instance status changes to “modifying.” Behind the scenes, RDS creates a snapshot, creates a new volume for the standby from the snapshot, and enables synchronous replication. This can be applied 'Immediately' (potentially causing disruption) or scheduled for a maintenance window. Elevated latency and performance impact may occur during conversion, especially for large storage volumes or heavy write workloads.

Multi-AZ vs. Read Replica Comparison

comparison-table

Understanding the distinct purposes and mechanisms of Multi-AZ deployments and Read Replicas is crucial for designing highly available and scalable RDS solutions.

This table highlights the key differences and use cases for Multi-AZ and Read Replicas in Amazon RDS.

Option Primary Purpose Replication Type Data Consistency Availability Enhancement Scalability Enhancement Read/Write Operations Automatic Failover Endpoint Supported Engines Cross-Region Deployment Disaster Recovery
Multi-AZ Deployment High availability and durability Synchronous Zero data loss during failover (guaranteed) Yes, protects against instance, storage, and AZ failures No (standby is not for reads, except for Multi-AZ Clusters with Readable Endpoints for MySQL/PostgreSQL) Primary for read/write; standby is passive (not directly accessible for read/write) Yes, automatic to standby Single endpoint, remains the same after failover All RDS engines (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server), Aurora (with specific cluster options) Standby must reside in the same region for Oracle, PostgreSQL, Microsoft SQL Server. Provides immediate failover within a region, contributing to regional DR.
Read Replicas Improve read scalability by offloading read traffic; enhance read availability Asynchronous Eventually consistent (replication lag possible), not guaranteed latest data Yes, can promote to new master if primary fails, but manual. Yes, scale out beyond capacity constraints of a single DB instance for read-heavy workloads Read-only; cannot be used for write operations No, manual promotion to a standalone DB instance is required for DR scenarios. Separate endpoint for each read replica, distinct from the primary. MySQL, MariaDB, PostgreSQL, Oracle, SQL Server (Aurora specifies as Aurora Replica). Yes, can be created in the same region, different AZ, or a different AWS Region for disaster recovery or global coverage. Can be used for Disaster Recovery (using cross-region read replicas), but requires manual promotion to a standalone instance.

Read Replicas

Read replicas are fundamental for scaling read-heavy workloads and improving the read availability of RDS database instances.

Read replicas are copies of a master database instance that are used to offload read traffic from the master instance, enhancing performance and availability. They provide enhanced performance and durability for RDS DB instances and make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.
Amazon RDS creates a second DB instance using a snapshot of the source DB instance. It then uses the engine's native asynchronous replication to update the read replica whenever there is a change to the source DB instance. Read-only connections are allowed; write traffic cannot be directed to read replicas. Updates to the source are asynchronously replicated, meaning the Read Replica is 'eventually consistent' and querying it does not guarantee the latest data will be returned. The 'Replication Lag' metric indicates how stale the data could be.
Read Replicas are supported by MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server engines. Aurora specifies them as Aurora Replicas. The number of read replicas varies by engine.
Technical Specs: Up to 15 read replicas for MySQL, PostgreSQL, MariaDB, and SQL Server. Up to 5 read replicas for Oracle. Aurora supports up to 15 Aurora replicas.
Read Replicas can be created in the same Availability Zone as the master instance, in a different Availability Zone, or in a different AWS Region.
Read replicas can be manually promoted to become the new master instance if the original master fails, or to become a new standalone primary database if the primary instance is deleted. There is no automation out-of-the-box for promotion in DR scenarios.
Both the primary and read replica instances have separate endpoints. Applications must update their connection strings to leverage them.
Read replicas are not automatically scaled for read traffic load balancing. Aurora has its own autoscaling capabilities for Aurora Replicas.
Use cases include scaling read-heavy workloads, redirecting excess read traffic, continuing to serve read traffic while the source database instance is unavailable, providing read-only copies for reporting or data warehousing, disaster recovery (by promoting a cross-region read replica), and lowering latency for cross-region applications.
For read replicas within the same AWS Region, there are no data transfer charges, even across different Availability Zones. For read replicas in different AWS Regions, data transfer charges apply based on data transferred out of the source region.

Read Replica Creation Procedure

procedure

Steps to create and manage an RDS Read Replica.

To create a read replica, select the primary instance and configure its properties.

Prerequisites

  • An existing RDS primary database instance
1

Select the primary instance in the RDS console.

💡 Read replicas are created from an existing primary instance.

2

Choose 'Action' and then 'Create Read Replica'.

💡 Initiates the read replica creation process.

3

Configure the read replica, similar to creating a primary instance.

💡 Define the properties for the new replica.

4

Specify identifier, size, region (can be cross-region), storage, availability (Single-AZ or Multi-AZ), public access (recommend “No”), and authentication.

💡 These settings define the replica's characteristics and location.

5

RDS handles snapshotting the primary instance and establishing replication to the replica.

💡 AWS automates the replication setup.

6

After creation, connect to the new endpoint provided for the read replica.

💡 Each read replica has its own endpoint for read-only access.

Amazon Aurora Specifics

Amazon Aurora is a proprietary, cloud-native relational database service designed for high performance and availability, offering unique architectural features and enhancements over standard RDS.

Aurora combines the speed and availability of high-end commercial databases with the simplicity and cost-effectiveness of open-source databases, tailored for the AWS cloud.

Overview and Core Architecture

Aurora is a proprietary, fully managed relational database service from AWS, designed for high performance and availability. It is compatible with MySQL and PostgreSQL, but unlike them, it is not open-source. Aurora is built specifically for the AWS cloud, claiming superior performance (up to 5x MySQL, over 3x PostgreSQL) without application code changes. It is also ACID compliant: Atomicity, Consistency, Isolation, and Durability.
Compatibility: MySQL and PostgreSQL
Performance: Up to 5x performance of MySQL on RDS, Over 3x performance of PostgreSQL on RDS

Key Benefits of Aurora

Aurora offers significant advantages in performance, scalability, and availability for mission-critical applications.
Performance: High performance, especially for read-heavy workloads.
Scalability: Storage autoscaling and increased replica limits.
High Availability: Instantaneous failover and native design for resilience.
Ease of Migration: Compatibility with existing applications, drivers, and tools.
Cost: Approximately 20% more expensive than RDS, but often more cost-efficient overall due to performance and reduced maintenance.
Use Cases:
  • Mission-critical applications requiring enterprise-grade performance

Aurora Database Cluster Architecture

Aurora architecture loosely couples compute and storage layers, allowing independent scaling. The storage layer maintains six copies of data across three Availability Zones (AZs) for high durability and fault tolerance.
Components: Database Instances (one or more instances for compute), Cluster Volume (a shared storage layer managing data for database instances).
Storage Layer: Maintains six copies of data across three AZs. Write operations require acknowledgment from four out of six storage nodes. Read/Repair operations require a quorum of three out of six read nodes. Can sustain the loss of an entire AZ and continue operating. Self-Healing with peer-to-peer replication and automatic healing of failed disks.
Primary Instance: Supports read and write operations, performs all data modifications to the cluster volume, responsible for SQL transactions and caching (compute layer).
Aurora Replicas: Up to 15 replicas, spread across multiple AZs. Can be promoted to primary in case of failure (fast failover, can take less than 30 seconds). Failover priority can be assigned.
Shared Storage Volume: Responsible for logging and data storage, backed by Amazon S3, with continuous backups to S3.

Aurora Read Replicas and Autoscaling

Aurora offers enhanced read replica capabilities and integrated autoscaling.
Replica Scalability: Up to 15 replicas (compared to 5 in standard RDS).
Replication Lag: Typically under 10 milliseconds (significantly faster than traditional MySQL).
Read Endpoint: Aurora provides a single reader endpoint for all read replicas.
Writer Endpoint: A separate endpoint for write operations.
Autoscaling Trigger: Aurora automatically adjusts the number of replicas based on workload, seamlessly integrated with Amazon CloudWatch.
Scaling Policy Configuration: Set target metrics (e.g., Average CPU utilization, Average database connections), using CloudWatch metric names RDS reader.CPUUtilization or RDS reader.DatabaseConnections. Specify minimum and maximum number of replicas and define a threshold value.
Scaling Mechanism: Scale-Up (when metrics exceed threshold, new replicas provisioned and join the reader endpoint), Scale-In (when metrics fall below threshold, unneeded replicas created by autoscaling are terminated).
Autoscaling Limitations: Aurora autoscaling only removes replicas it created, not manually added ones or those added via infrastructure-as-code.
Replica Instance Class: New replicas added by autoscaling match the instance class of the primary instance.

Aurora Custom Endpoints

Custom endpoints address scenarios where different query priorities or resource needs exist within an Aurora cluster, allowing workload segregation. This prevents resource-intensive queries from impacting core application performance by routing connections to a specific, user-defined subset of instances within an Aurora cluster.
Endpoint Types: Can be created for read operations, write operations, or a combination.
Performance Optimization: Allows using different instance sizes for different custom endpoints to efficiently allocate resources.
Default Endpoints: Reader Endpoint (handles simple load balancing across all read replicas), Writer/Cluster Endpoint (used for write operations (INSERT, UPDATE, DELETE)).
Use Cases:
  • Separating heavy analytical/reporting queries from high-volume transactional queries for a web application.

Aurora Single-Master Cluster

An Amazon Aurora single-master cluster consists of a primary instance. Aurora provides a cluster endpoint that always points to the primary instance. An Aurora cluster also may include Aurora replicas. The primary and all replicas share a single cluster volume, which is synchronously replicated across three availability zones. This cluster volume automatically expands as needed.
Cluster Volume Size: Automatically expands up to 64 TB.
Instance Fail Scenario A (No Replicas): Aurora will create a new primary instance to replace the failed one.
Instance Fail Scenario B (Replica Exists): Aurora will promote the replica to the primary.

Aurora Multi-Master Cluster

In a multi-master cluster, all instances can write to the database. This design provides continuous availability because if one instance fails, no failover occurs as all instances can continue to write to the shared cluster volume.

Amazon Aurora Global Database

Designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS regions. It replicates data with no impact on database performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages, offering more comprehensive failover capabilities than a default Aurora DB cluster.
RTO (Recovery Time Objective): Can be in the order of minutes for an Aurora global database.
RPO (Recovery Point Objective): Typically measured in seconds for an Aurora global database.
Managed Planned Failover: Intended for controlled environments (disaster recovery (DR) testing scenarios, operational maintenance, and other planned operational procedures). Allows relocation of the primary DB cluster to one of the secondary Regions. RPO is 0 (no data loss) as secondary DB clusters are synchronized with the primary before making any other changes.
Unplanned Failover ('detach and promote'): To recover from an unplanned outage, cross-Region failover to one of the secondaries. RTO depends on how quickly tasks are performed; RPO is typically measured in seconds, depending on Aurora storage replication lag across the network at the time of the failure.

Aurora Serverless

An on-demand, auto-scaling configuration for Amazon Aurora (MySQL-compatible and PostgreSQL-compatible editions). The database automatically starts up, shuts down, and scales capacity up or down based on application needs. It allows running your database in the cloud without managing any database instances.
Cost Model: Pay on a per-second basis for database capacity used when active.
Migration: Can migrate between standard and serverless configurations with a few clicks in the Amazon RDS Management Console.
Use Cases:
  • Infrequent, intermittent, or unpredictable workloads.

Aurora Database Cloning

A feature that creates a complete, ready-to-use copy of an existing Aurora database cluster in minutes, regardless of database size. It's significantly faster and more cost-efficient than traditional snapshot and restore due to Aurora’s decoupled storage architecture. The new clone cluster shares the exact same underlying distributed storage volume as the original source cluster initially, using a copy-on-write protocol for subsequent modifications.
Initial State: Near-instantaneous, no data copied initially. Both source and clone reference same data pages.
Copy-on-Write Protocol: When data is modified in either the source or the clone, instead of overwriting a shared data page, a new copy of that page is created for the modifying cluster. The modified cluster updates its pointer to the new data page, while the unchanged cluster continues to reference the original shared pages.
Independence: After cloning, source and clone clusters are completely independent; changes to one do not affect the other.
Cloning Limit: Currently limited to 15 clones based on a copy (including clones based on other clones). Each copy can also have up to 15 clones.
Cross-Region: Cannot clone databases across AWS regions. Clone databases must be created in the same region as the source databases.
Use Cases:
  • Creating development or testing environments
  • Performance testing
  • Debugging production issues with isolated data.

Backup and Recovery

RDS and Aurora offer robust backup and recovery mechanisms to protect data and ensure business continuity.

Data protection is a core feature, including automated daily backups, manual snapshots, and advanced Aurora-specific capabilities.

RDS Automated Backups

Automated backups are enabled by default for RDS instances. They are performed daily during a defined backup window. Transaction logs are continuously uploaded to Amazon S3 every 5 minutes.
Default Status: Enabled by default.
Frequency: Daily backup performed during a defined backup window (maintenance window).
Backup Window: When backups should be taken; by default, RDS randomly selects a 30-minute window within an 8-hour block that varies by region. Choose a time when the database is least busy.
Transaction Logs: Continuously uploaded to Amazon S3 every 5 minutes.
Point-in-Time Recovery (PITR): Achieved by combining transaction logs and daily backups, allowing restoration to any second within the retention period, up to the last 5 minutes.
Retention Period: Configurable from 1 day to a maximum of 35 days. Setting to 0 disables automated backups. Default in AWS Console is 7 days; default via RDS API/AWS CLI is 1 day.
Disabling Automated Backups: Immediately deletes all existing automated snapshots and disables point-in-time recovery. Changing retention from 0 to any other value triggers an immediate snapshot.
Storage: Snapshots include all databases on the instance and are stored in an RDS-owned S3 bucket. They are kept in multiple zones in the same region for redundancy.
Performance Impact (Single-AZ): Brief I/O suspension (few seconds - few minutes).
Performance Impact (Multi-AZ): No I/O suspension.

RDS Manual Snapshots

Users can create manual snapshots of their database instances (including read replicas) for point-in-time backups. These snapshots offer more control over the backup strategy and persist until explicitly deleted, not being subject to automated retention periods. They are useful for compliance and long-term data retention requirements.
Persistence: Persist until explicitly deleted.
Capture Level: For multi-instance database clusters, a manual snapshot captures the entire cluster.
Incremental Nature: The first snapshot of a DB Instance contains all the data. Subsequent snapshots are incremental, storing only what has changed since the last snapshot.
Actions: Can be restored, copied, shared, migrated, upgraded, or exported to Amazon S3.

Aurora Backup and Recovery Features

Aurora supports all default RDS backup and restore capabilities but also offers more advanced features specific to its architecture.
Automated Backups: Always enabled on Aurora DB instances. They are continuous and incremental, stored in Amazon S3, and do not impact database performance or availability. You cannot disable automated backups on Aurora.
Backup Retention Period: 1-35 days (1 day is default for automated backups).
Snapshots: You can take a snapshot of the data in your cluster volume to retain data beyond the backup retention period. Aurora DB cluster snapshots don't expire. A new DB cluster can be created from a snapshot. After the Aurora cluster associated with a snapshot is deleted, storing that snapshot incurs the standard backup storage charges for Aurora.
Backtrack: Rewinds the database to any point in time within a configured period (up to 72 hours) without relying on traditional backups, minimizing data loss from user errors.
Clustering and Copy on Write: Creates cluster-level backups. Allows creation of new clusters sharing the original cluster’s data volume, where only changed blocks are copied, making cloning extremely fast and efficient for staging environments.
Continuous Data Protection: Enables continuous data backups with a user-defined retention period (up to 35 days), ensuring data is always protected. This operates with native Point-in-Time Recovery without impacting database performance or availability.
Scope: Standard RDS backups are instance-level; Aurora backups are cluster-level (encompassing all instances within the cluster).

Restoring Backups Procedure

procedure

Restoring an RDS backup involves creating a new database instance and configuring its settings.

Backups are based on storage volume snapshots. Restoring a backup creates a new Database Instance.

Prerequisites

  • An existing RDS automated backup or manual snapshot.
1

Select the desired snapshot or point-in-time from the RDS console.

💡 Identifies the specific recovery point.

2

Initiate the restore process.

💡 This will create a new DB instance.

3

Define Instance Configuration for the new instance, just like provisioning a new instance.

💡 Allows setting up the new instance with desired specifications.

4

Parameter Group and Security Group settings are retained from the original instance by default.

💡 Ensures consistency with the original database's behavior and network access.

Security Features

Amazon RDS implements a multi-layered security approach to protect your databases.

Security in RDS covers network isolation, access control, data encryption at rest and in transit.

Network Security

Network isolation is a fundamental layer in the security model, enabled by Virtual Private Cloud (VPC).
Placement: Always place RDS/Aurora/production databases in a private subnet within your VPC. Turn off Public Accessibility to restrict access outside the VPC.
Security Group: Database Instance IP firewall protection, securely controls network configuration, allowing connections only from application servers.
Network ACLs (NACLs): Use as an additional stateless security layer at the subnet level.
Connectivity: Use ClassicLink to network with non-VPC resources, DirectConnect to replicate with an on-premise database, and VPC Peering to share between VPCs.

Access Control

Multiple options are available to control who can perform actions on RDS resources and grant access within the database.
Managing the Database: Use IAM to control who can perform actions on RDS resources. Do not use AWS root credentials. Use MFA (Multi-Factor Authentication) to provide an extra level of protection.
Grant Access within the Database: Same as on-premise. Do not use Master credentials. Options include Integrated Security, Active Directory for SQL Server, and IAM Authentication for MySQL, PostgreSQL, and Aurora.

Encryption at Rest

Encryption at rest for your Database Instance is provided by AWS KMS using industry-standard AES-256 encryption. It is free with no associated costs or performance impact.
Mechanism: Encryption is done at the volume level, meaning no impact to the application.
Scope: Data that is encrypted at rest includes the underlying storage for DB instances, its automated backups, read replicas, and snapshots.
Inheritance: If the primary is encrypted, all nodes are encrypted, including backups and snapshots. This includes cross-region copies.
Enablement: You can only enable encryption when you create it, not after the DB instance is created. You can't unencrypt once you encrypt.
Snapshot Encryption: You can encrypt a copy of an unencrypted DB snapshot to effectively add encryption to an unencrypted DB instance. This involves creating a snapshot of your DB instance, then creating an encrypted copy of that snapshot.
Key Management: Access to KMS keys is logged. Supports Two Tier Encryption with master keys created by you, and each instance having its own data key.

SSL for Database Connectivity (Encryption in Transit)

SSL connectivity provides confidence that traffic between your database and client/application is not intercepted or tampered with, and that you are connecting to the intended database. This is achieved using SSL/TLS certificates to secure connections between applications and the database endpoint.
Enforcement: Optionally 'Enforce SSL' via Parameter Groups using 'rds.force_ssl' and 'ssl' parameters (e.g., setting to 1 instead of 0 for PostgreSQL).

Monitoring and Performance

Monitoring is essential for ensuring the reliability, availability, and performance of RDS databases.

RDS provides various tools and metrics through Amazon CloudWatch and Performance Insights to track database health and performance.

CloudWatch Monitoring Metrics

Key performance metrics are visible in Amazon CloudWatch for database instances.
Key Metrics: CPU utilization, Disk Queue Depth, IO Latency, IO Throughput. Also Storage Space, Network Traffic, DB Connections, IOPS (Performance of Storage).

Enhanced Monitoring

Enhanced Monitoring provides more granular, operating system/host-level metrics compared to standard CloudWatch metrics.
Granularity: As low as 1 second (default is 60 seconds).
Metrics: 50 additional metrics available in CloudWatch.
Mechanism: Provided from a lightweight agent on the host (Enhanced), whereas standard metrics are provided from outside the host (hypervisor).

Performance Insights

Performance Insights is a database performance monitoring feature integrated with CloudWatch, providing metrics to analyze database performance and identify bottlenecks. Performance data may be limited for databases with minimal activity.
Key Metrics: Top SQL queries, Top Wait Time, Top Host, User, Session Type, and Application. Core performance metrics like IO Latency and IO Throughput.

Other Monitoring Tools

AWS offers additional services that integrate with RDS for event notification, configuration tracking, and auditing.
AWS RDS Events: Be notified when an RDS Management event occurs.
AWS Config: Records and evaluates changes to configuration.
AWS CloudTrail: Audit log of the API calls made to the RDS.
AWS Trusted Advisor: Provides cost optimization, security, fault tolerance, and performance improvement recommendations.

Cost Management and Optimization

Managing costs effectively is a key aspect of operating RDS databases. AWS provides various mechanisms for cost optimization.

Understanding RDS cost drivers and leveraging features like Reserved Instances and Storage Autoscaling can lead to significant savings.

Four Primary Cost Drivers

RDS costs are influenced by several factors related to instance usage, storage, and data transfer.
Instance Hours: Based on Region, Instance Type, Database Engine, and License.
Backup Storage: Size of backups stored in AWS. No charge for backup storage up to 100% of total database storage.
Database Storage: Affected by EBS vs Aurora, Storage Type (GP2/IO1/Magnetic), and Storage Allocation (GB).
Data Transfer: Outgoing traffic only, based on Regional Data Transfer Pricing. Includes copying region to region.

Reserved Instances (RIs)

For production workloads with predictable usage over 1 or 3 years, purchasing RDS Reserved Instances can significantly reduce costs compared to on-demand rates.
Purchase Options: Select database engine, instance class, deployment option, and payment term (upfront, partial, or no upfront payment).

Storage Autoscaling (for RDS MySQL, MariaDB, PostgreSQL, Oracle, SQL Server)

Automatically scales up database storage for unpredictable workloads, avoiding manual intervention. When enabled, RDS detects when free database space is running low and automatically scales up storage. Storage cannot be reduced once incremented.
Trigger Conditions: Free available space is less than 10 percent of the allocated storage, OR the low-storage condition lasts at least five minutes, OR at least six hours have passed since the last storage modification, OR predicted storage growth exceeding current allocated size in the next 7 hours (based on free storage metrics).
Increment: Increments storage by the larger of 10 GB or 10% of currently allocated storage.
Maximum Storage Threshold: Must be configured. Default Max: 1,000 GB (1 TB). Minimum: 440 GB. Maximum: 65 TB. Cannot set threshold greater than maximum allocated storage.
Limitations: Cannot be used with magnetic storage devices or EBS magnetic volume types.

Database Lifecycle Management and Operations

procedure

RDS provides tools for managing the complete lifecycle of database instances, from creation to modification and deletion.

Managing RDS instances includes creation, modification, and proper cleanup to avoid ongoing costs.

Prerequisites

  • Appropriate IAM permissions
1

Database Creation Process

💡 Initiates and monitors the provisioning of a new database instance.

2

Configure instance settings (Easy Create or Standard Create) and await 'Creating' -> 'Backing up' -> 'Available' status transitions.

💡 Ensures the database is set up with desired parameters and is ready for use.

3

Utilize the provided unique connection Endpoint to access the database.

💡 The endpoint is the primary access method for applications and clients.

4

Modify Database Instances Post-Creation

💡 Adjusts instance parameters as workload or requirements change.

5

Many parameters can be modified, including engine version (cannot downgrade), password, instance size (vertical scaling), allocated storage, security groups, and deletion protection. Changes can be applied immediately or during the next maintenance window.

💡 Allows for flexible scaling and configuration updates.

6

Perform Replica Instance Actions

💡 Manages the state and functionality of read replicas.

7

Read replicas offer a range of actions, including rebooting, deleting, connecting them to EC2/Lambda, promoting them to standalone databases, converting them to Multi-AZ, turning on backups, taking snapshots, and creating associated RDS Proxy or ElastiCache clusters.

💡 Enables flexible management of read scalability and recovery options.

8

Database Deletion and Cleanup

💡 Removes resources and prevents unexpected costs.

9

Ensure 'Deletion Protection' is enabled to prevent accidental deletion of production databases. It must be explicitly disabled before the instance can be deleted.

💡 This crucial safety feature prevents accidental deletion.

10

When deleting, choose whether to retain automated backups and whether to create a final snapshot (recommended for production). Confirmation requires typing 'delete me' and acknowledging the loss of automated backups and point-in-time recovery if not retained.

💡 Provides options for data retention and confirms intent.

11

If the primary instance is deleted, a read replica can be promoted to become a new standalone primary database, maintaining data availability.

💡 Supports recovery and business continuity.

12

Delete any manual snapshots directly. System snapshots cannot be deleted directly and are tied to automated backup retention or deleted when the instance is deleted and backups are not retained.

💡 Removes snapshot storage costs.

13

Follow comprehensive cleanup steps: Delete all database instances, delete any manual snapshots, delete any retained automated backups. Verify the RDS dashboard shows zero instances, snapshots, or active backups.

💡 Ensures no lingering resources incur charges.

Migration to RDS/Aurora

Migrating existing on-premises databases to Amazon RDS or Aurora requires specific strategies as direct restoration of backup files is generally not supported.

On-premises backup files (.bak, .sql) cannot be directly restored to RDS/Aurora using a simple restore command.
For migrating on-premises Oracle databases to AWS, Amazon RDS for Oracle is the correct service. It is designed for Oracle databases in the AWS cloud with full Oracle compatibility and supports all major Oracle editions. RDS for Oracle automates backups, patching, monitoring, scaling, and high availability. It supports Oracle SQL, PL/SQL, and database features, and databases up to 64 TB. It also offers Bring Your Own License (BYOL) and License Included options.
Technical Specs: Supports databases up to 64 TB; supports Enterprise, Standard, Express, Personal Oracle editions.
Two primary methods are available for migrating MySQL/PostgreSQL databases: Logical Migration for offline transfers and Assisted Migration using AWS DMS for online transfers.

Logical Migration (Offline) Procedure

procedure

A suitable method for smaller databases and planned migrations with acceptable downtime.

This method involves exporting data, uploading it to S3, and then restoring it to a new RDS/Aurora instance.

Prerequisites

  • On-premises database (MySQL/PostgreSQL)
  • AWS S3 bucket
  • EC2 instance in the same VPC as target RDS/Aurora
  • MySQL client tool (e.g., mysqldump, psql)
1

Export data from the on-premises database to a logical dump file.

💡 Creates a portable representation of the database schema and data.

mysqldump -u [username] -p[password] [database_name] > [dump_file.sql]
2

Upload the dump file to Amazon S3.

💡 Provides secure and durable storage for the dump file, accessible from AWS.

aws s3 cp [dump_file.sql] s3://[your-s3-bucket]/[dump_file.sql]
3

Create a target RDS/Aurora database instance that is compatible with the source engine.

💡 Provisions the AWS managed database where the data will reside.

4

Restore data from the S3 file using a client tool (e.g., MySQL client from an EC2 instance in the same VPC).

💡 Ingests the data into the newly created RDS/Aurora instance.

mysql -h [rds_endpoint] -u [username] -p[password] [database_name] < [dump_file.sql]

Assisted Migration (Online) using AWS Database Migration Service (DMS) Procedure

procedure

AWS DMS provides an online migration approach with minimal to zero downtime for migrating databases.

DMS facilitates a full load of data and optionally replicates ongoing changes to keep source and target databases in sync.

Prerequisites

  • On-premises source database
  • Target RDS/Aurora cluster
  • AWS DMS replication instance
1

Create an AWS DMS replication instance.

💡 This is a server that performs the actual migration tasks.

2

Configure source (on-premises database) and target (Aurora/RDS cluster) endpoints in DMS.

💡 DMS needs to know where to read data from and where to write it.

3

Create and run a migration task: DMS performs a full load and optionally replicates ongoing changes (Change Data Capture - CDC) to keep databases in sync.

💡 Transfers historical data and applies real-time updates.

4

Optionally configure a VPN connection or Direct Connect for secure, dedicated channels between on-premises and AWS.

💡 Ensures secure and reliable data transfer for the migration.

5

Once replication is complete, point applications to the new AWS database and perform a cutover.

💡 Switches live traffic to the migrated database.

Storage Types

Amazon RDS and Aurora offer different storage types to meet varying performance and cost requirements.

Choosing the right storage type is crucial for database performance.

General Purpose SSD (GP2/GP3)

SSD-backed storage suitable for a broad range of transactional workloads. Typically SSD GP3 EBS volumes are used.
Max Capacity: 16TB
IOPS: 3 IOPS per GB, bursts to 3000 IOPS

Provisioned IOPS SSD (IO1)

SSD-backed storage designed for I/O-intensive workloads, providing consistent I/O performance.
Max Capacity: 16TB
Max IOPS: 40K IOPS (20K for SQL)

Magnetic

Older storage type, generally supported for Legacy DBs.
Max Capacity: 16TB

Aurora Proprietary Storage System

Aurora uses its own proprietary, cloud-native storage system, which is self-healing and automatically repairs data blocks and disks.

Exam Tips

Glossary

DB Instance Identifier
A unique name for your database instance.
Master Username
The primary user for connecting to the database.
Option Group
Controls various database features.
Subnet Group
Defines the subnets your database can reside in.
DB Parameter Group
A group of parameters which define the configuration of the Database Instance.
Instance Class
The size of the instance, which determines the amount of CPU, memory, and storage available to the instance.
Multi-AZ Deployment
A high-availability option that automatically creates a standby replica of the instance in a different availability zone. If the primary instance fails, the standby replica can take over automatically.
Read Replicas
Copies of a master database instance that are used to offload read traffic from the master instance, enhancing performance and durability for RDS DB instances.
Primary Host
The main instance in RDS that is used for read and write operations.
Secondary Host
A standby replica that can be used for read operations if the primary host fails. Part of the multi-AZ deployment feature.
Recovery Time Objective (RTO)
The time it takes a system to return to a working state after a disaster. In other words, RTO measures downtime. For an Aurora global database, RTO can be in the order of minutes.
Recovery Point Objective (RPO)
The amount of data that can be lost (measured in time). For an Aurora global database, RPO is typically measured in seconds.
Change Data Capture (CDC)
A process of identifying and capturing changes made to database tables and then delivering those changes to a target system. Used in AWS DMS for ongoing replication.

Key Takeaways

Content Sources

Amazon RDS - A Comprehensive Guide to... RDS Amazon Relational Database Service (R... API Gateway Stage and Canary Deployments Managing API Deployments and Rollouts... Extracted: 2026-01-23 16:24:43.653799 Model: gemini-2.5-flash