DevOps Peach

AWS Basics · Databases on AWS – RDS, Aurora, and ElastiCache · Lesson 3 of 5

RDS Security

Protect RDS with private networking, encryption, and IAM.

Practice interactively →

Networking, identity, and encryption

RDS normally belongs in private subnets listed in a DB subnet group across at least two AZs, with Publicly accessible set to No. Its Security Group should allow the engine port only from an application Security Group or controlled administration path, never 0.0.0.0/0.

flowchart LR
  APP["App instances<br/>sg-app"] -- "5432 + TLS" --> SG["DB Security Group<br/>5432 from sg-app"]
  SG --> DB["RDS PostgreSQL<br/>private subnets"]
  KMS["KMS key<br/>encryption at rest"] --> DB
  IAM["IAM auth token<br/>15-minute"] -.-> DB
  SM["Secrets Manager<br/>rotated password"] -.-> APP
  %% step APP: Only the application tier needs to reach the database.
  %% step SG: The DB Security Group references the app's Security Group instead of IP ranges.
  %% step DB: The database has no public IP and lives in private subnets.
  %% step KMS: Storage, backups, snapshots and replicas are encrypted with a KMS key chosen at creation.
  %% step IAM: With IAM database authentication, the app connects with a short-lived token instead of a password.
  %% step SM: Or it reads a password from Secrets Manager, which can rotate it automatically.

Encryption at rest

At-rest encryption uses KMS and must be selected during creation or restore. To convert an unencrypted database, snapshot it, create an encrypted snapshot copy, restore a new database, test, and cut over. Encrypted snapshots remain encrypted, and a read replica of an encrypted instance is encrypted with the same or a chosen key. To share an encrypted snapshot with another account, use a customer managed key and grant that account access to it.

Encryption in transit

TLS protects data in transit. Download the RDS CA bundle and configure the client to verify the server certificate (sslmode=verify-full for PostgreSQL). You can force TLS with a parameter: rds.force_ssl=1 (PostgreSQL, SQL Server) or require_secure_transport=ON (MySQL). Rotate CA certificates before they expire.

Authentication

Method How Good for
Database password Master user created at launch, others via SQL Every engine
Secrets Manager RDS can manage the master password and rotate it Removing passwords from code
IAM database authentication generate-db-auth-token, valid 15 minutes MySQL, MariaDB, PostgreSQL
Kerberos Active Directory via AWS Directory Service SQL Server, Oracle, MySQL, PostgreSQL

IAM database authentication creates short-lived tokens for supported engines and configurations and requires TLS; IAM allows connection (rds-db:connect), while the database user must still exist with SQL privileges.

Shared responsibility

AWS patches the host and service; you own public accessibility, Security Groups, parameter groups, database users and their privileges, and certificate validation. Give applications users with only the privileges they need, never the master user.

Auditing

Export engine logs (PostgreSQL logs, MySQL audit/error/slow-query logs) to CloudWatch Logs; CloudTrail records API calls such as ModifyDBInstance or DeleteDBInstance. Turn on deletion protection for production databases.

Command Purpose
aws rds copy-db-snapshot --source-db-snapshot-identifier db-plain --target-db-snapshot-identifier db-enc --kms-key-id alias/rds-key Create an encrypted copy
aws rds describe-db-instances --query "DBInstances[].[DBInstanceIdentifier,PubliclyAccessible,StorageEncrypted]" Audit networking and encryption
aws rds generate-db-auth-token --hostname db-prod.xxxx.ap-southeast-1.rds.amazonaws.com --port 5432 --username app_user Get an IAM auth token
aws rds modify-db-instance --db-instance-identifier db-prod --deletion-protection Prevent accidental deletion

Traps: making the database publicly accessible to "test quickly"; expecting to turn on encryption for a running instance; thinking an IAM policy alone creates the database user.

Practice interactively →