RDS & Aurora

RDS Fundamentals

Amazon Relational Database Service (RDS) is a managed relational database supporting MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon Aurora.

Supported Engines

Create RDS Instance

# Create a MySQL RDS instance
aws rds create-db-instance \
  --db-instance-identifier mydb \
  --db-instance-class db.t3.micro \
  --engine mysql \
  --engine-version 8.0 \
  --master-username admin \
  --master-user-password SecurePass123! \
  --allocated-storage 20 \
  --max-allocated-storage 100 \
  --storage-type gp3 \
  --storage-encrypted \
  --vpc-security-group-ids sg-xxx \
  --db-subnet-group-name my-subnet-group \
  --backup-retention-period 7 \
  --preferred-backup-window 03:00-04:00 \
  --preferred-maintenance-window sun:04:00-sun:05:00 \
  --multi-az \
  --publicly-accessible false

# Check status
aws rds describe-db-instances --db-instance-identifier mydb

Connection

# Get endpoint
aws rds describe-db-instances \
  --db-instance-identifier mydb \
  --query 'DBInstances[0].Endpoint.Address'

# Connect with MySQL client
mysql -h mydb.xxxx.us-east-1.rds.amazonaws.com -u admin -p

Multi-AZ and Read Replicas

Multi-AZ Deployment

Provides high availability with automatic failover to a standby replica in a different AZ.

# Enable Multi-AZ
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --multi-az \
  --apply-immediately

# Check Multi-AZ status
aws rds describe-db-instances \
  --db-instance-identifier mydb \
  --query 'DBInstances[0].[MultiAZ,StatusInfos]'

Read Replicas

Create read-only copies for scaling read traffic.

# Create a read replica
aws rds create-db-instance-read-replica \
  --db-instance-identifier mydb-replica-1 \
  --source-db-instance-identifier mydb \
  --instance-class db.t3.medium

# Create cross-region read replica
aws rds create-db-instance-read-replica \
  --db-instance-identifier mydb-eu-replica \
  --source-db-instance-identifier arn:aws:rds:us-east-1:xxx:db:mydb \
  --source-region us-east-1 \
  --region eu-west-1

# Promote read replica to standalone
aws rds promote-read-replica --db-instance-identifier mydb-replica-1

Multi-AZ vs Read Replicas

Backup and Recovery

Automated Backups

# Configure backup retention
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --backup-retention-period 35 \
  --preferred-backup-window 03:00-04:00

# Take a manual snapshot
aws rds create-db-snapshot \
  --db-instance-identifier mydb \
  --db-snapshot-identifier manual-backup-$(date +%Y%m%d)

# Copy snapshot to another region
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier arn:aws:rds:us-east-1:xxx:snapshot:mydb-snapshot \
  --target-db-snapshot-identifier mydb-snapshot-eu \
  --source-region us-east-1 \
  --region eu-west-1

# List snapshots
aws rds describe-db-snapshots \
  --db-instance-identifier mydb \
  --query 'DBSnapshots[*].[DBSnapshotIdentifier,Status,SnapshotCreateTime]' \
  --output table

Point-in-Time Recovery

# Restore to a specific point in time
aws rds restore-db-instance-to-point-in-time \
  --source-db-instance-identifier mydb \
  --target-db-instance-identifier mydb-restored \
  --restore-time "2024-01-15T14:30:00Z"

# Restore to a specific second
aws rds restore-db-instance-to-point-in-time \
  --source-db-instance-identifier mydb \
  --target-db-instance-identifier mydb-restored \
  --use-latest-restorable-time

Backup Window Strategy

00:00  03:00  04:00  06:00  12:00  18:00  23:59
  |──────|██████|──────|                              
       Backup Window                                  
       (03:00-04:00 UTC)                             

High traffic hours: 09:00-18:00                       
Maintenance window: sun:04:00-sun:05:00

Amazon Aurora

Aurora provides MySQL and PostgreSQL compatibility with 5x MySQL and 3x PostgreSQL performance.

Aurora Features

• Storage: Auto-scales 10 GB to 128 TB
• Replicas: Up to 15 read replicas
• Backups: Continuous to S3, no performance impact
• High Availability: 6 copies of data across 3 AZs

Create Aurora Cluster

# Create Aurora MySQL cluster
aws rds create-db-cluster \
  --db-cluster-identifier myaurora-cluster \
  --engine aurora-mysql \
  --engine-version 8.0.mysql_aurora.3.04.0 \
  --master-username admin \
  --master-user-password SecurePass123! \
  --backup-retention-period 7 \
  --preferred-backup-window 03:00-04:00

# Create primary instance
aws rds create-db-instance \
  --db-instance-identifier myaurora-primary \
  --db-instance-class db.r6g.large \
  --engine aurora-mysql \
  --db-cluster-identifier myaurora-cluster

# Create read replica
aws rds create-db-instance \
  --db-instance-identifier myaurora-replica-1 \
  --db-instance-class db.r6g.large \
  --engine aurora-mysql \
  --db-cluster-identifier myaurora-cluster

Aurora Serverless v2

# Create Serverless cluster
aws rds create-db-cluster \
  --db-cluster-identifier myserverless-cluster \
  --engine aurora-postgresql \
  --engine-version 14.7 \
  --master-username admin \
  --master-user-password SecurePass123! \
  --serverless-v2-scaling-configuration '{
    "MinCapacity": 0.5,
    "MaxCapacity": 16,
    "SecondsUntilAutoPause": 300
  }'

# Create serverless instance
aws rds create-db-instance \
  --db-instance-identifier myserverless-instance \
  --db-instance-class db.serverless \
  --engine aurora-postgresql \
  --db-cluster-identifier myserverless-cluster

Aurora Global Database

# Create global database
aws rds create-global-cluster \
  --global-cluster-identifier my-global-db \
  --engine aurora-postgresql \
  --engine-version 14.7

# Add secondary region
aws rds create-db-cluster \
  --db-cluster-identifier myaurora-eu \
  --engine aurora-postgresql \
  --global-cluster-identifier my-global-db \
  --region eu-west-1

RDS Security and Best Practices

Encryption

# Enable encryption at rest
aws rds create-db-instance \
  --db-instance-identifier mydb \
  --storage-encrypted \
  --kms-key-id alias/aws/rds

# Encryption in transit
# Use SSL/TLS connections:
mysql -h mydb.xxxx.us-east-1.rds.amazonaws.com -u admin -p --ssl-ca=rds-combined-ca-bundle.pem

IAM Authentication

# Enable IAM authentication
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --enable-iam-database-authentication

# Create IAM policy for RDS access
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "rds-db:connect",
    "Resource": "arn:aws:rds-db:us-east-1:123456789012:dbuser:xxx/db-user"
  }]
}

# Generate auth token
aws rds generate-db-auth-token \
  --hostname mydb.xxxx.us-east-1.rds.amazonaws.com \
  --port 3306 \
  --username db-user \
  --region us-east-1

Parameter Groups

# Create a parameter group
aws rds create-db-parameter-group \
  --db-parameter-group-family mysql8.0 \
  --db-parameter-group-name my-custom-params \
  --description "Custom MySQL parameters"

# Modify parameters
aws rds modify-db-parameter-group \
  --db-parameter-group-name my-custom-params \
  --parameters 'ParameterName=max_connections,ParameterValue=500,ApplyMethod=pending-reboot' \
  --parameters 'ParameterName=innodb_buffer_pool_size,ParameterValue=2684354560,ApplyMethod=pending-reboot'

# Apply to instance
aws rds modify-db-instance \
  --db-instance-identifier mydb \
  --db-parameter-group-name my-custom-params \
  --apply-immediately

Cost Optimization

• Use db.t3.micro for dev/test (burstable)
• Reserved Instances for production (up to 60% savings)
• Right-size based on CloudWatch metrics
• Use Storage Auto Scaling instead of over-provisioning