Databases on AWS - networking, security, backup (console)

In full-system labs, the database layer fails when network placement, secrets, or backup are treated as afterthoughts.

Checklist: DevOps checklist · Data services overview

RDS architecture (subnets): Amazon RDS inside a VPC

Use cases

Engine	Typical workload
Aurora PostgreSQL/MySQL	HA OLTP, read replicas
RDS PostgreSQL/MySQL	Standard relational
DynamoDB	Serverless key-value/document
DocumentDB	Mongo-compatible (TLS guide)

This post focuses RDS/Aurora VPC relational patterns; DynamoDB adds VPC endpoints and IAM instead of SG:3306.

Architecture (relational)

App tier (ECS/EKS/Lambda in VPC) ──SG:5432──► RDS in DB subnets (2+ AZ)
                     │
                     └── Secrets Manager (master creds) + optional IAM DB auth

Rules:

DB subnets - dedicated private subnets per AZ in DB subnet group.
No public accessibility in production.
Multi-AZ for prod RDS; Aurora storage is HA by design - still place instances across AZs.

Console - create DB subnet group

RDS → Subnet groups → Create.
Select VPC and private subnets in ≥2 AZs.
Name: prod-db-subnets.

Console - create RDS/Aurora instance

RDS → Create database.
Engine: Aurora or RDS.
Templates: Production → Multi-AZ where applicable.
Connectivity:

VPC + DB subnet group
Public access: No
VPC security group: create rds-app-sg allowing only app SG on DB port.

Encryption: enable at rest (KMS CMK).
Authentication: enable IAM database authentication if apps use IAM tokens (Lambda RDS IAM).
Backup:

Retention (e.g. 7-35 days)
Backup window
Copy tags to snapshots

Security groups (critical)

SG	Inbound
`rds-sg`	TCP 5432/3306 from `app-sg` only
`app-sg`	From ALB or mesh - not open to world

Hybrid: add on-prem CIDR only if Site-to-Site VPN/DX exists (VPN guide).

Secrets & rotation

Secrets Manager → store master password or use RDS integration.
Enable rotation (Lambda in VPC with RDS SG access).
Applications read secret via task role - never bake passwords in images.

Backup & DR

Feature	Console
Automated backups	RDS → Maintenance & backups
Manual snapshot	Snapshots → Take snapshot
Cross-region copy	Snapshot → Copy
AWS Backup	Central vaults, legal hold, cross-account

Restore drill: quarterly restore to staging cluster from snapshot.

Commonly missed

Miss	Risk
DB in single AZ subnet group mistake	Cannot enable Multi-AZ
App and DB different VPCs without peering/TGW	Connection timeout
SG allows entire VPC CIDR	Over-broad blast radius
`max_connections` vs app pool size	Exhaustion under load
Deletion protection off	Accidental destroy

Troubleshooting

Symptom	Check
Timeout	SG, subnet route, wrong endpoint (reader vs writer)
`password authentication failed`	Secret rotation drift
SSL required	Download RDS CA bundle; enforce `sslmode`
Storage full	Autoscaling max; alarms on `FreeStorageSpace`

Docs: RDS in VPC · Aurora best practices

← Checklist