Skip to content

Latest commit

 

History

History
117 lines (101 loc) · 5.44 KB

rds.md

File metadata and controls

117 lines (101 loc) · 5.44 KB
Raw

AWS RDS - Relational Database Service

  • It is a managed database service for relational databases
  • It allows us to create databases in the cloud that are managed by AWS
  • RDS offerings provided by AWS:
    • PostreSQL
    • MySQL
    • MariaDB
    • Oracle
    • Microsoft SQL Server
    • Aurora
  • Advantages of AWS RDS over deploying an relational database on EC2:
    • RDS is a managed service, meaning:
      • Automated provisioning, OS patching
      • Continuous backups and restore to specific timestamp (Point in Time Restore)
      • Monitoring dashboards
      • Read replicas
      • Multi AZ setup
      • Maintenance windows for upgrades
      • Scaling capability (vertical and horizontal)
      • Storage backed by EBS (GP2 or IO)
  • Disadvantages:
    • No SSH into the instance which hosts the database

RDS Backups

  • Backups are automatically enabled in RDS
  • AWS RDS provides automated backups:
    • Daily fill backup of the database (during the maintenance window)
    • Transaction logs are backed-up by RDS every 5 minutes which provides the ability to do point in time restores
    • There is a 7 day retention for the backups which can be increased to 35 days
  • DB Snapshots:
    • There are manually triggered backups by the users
    • Retention can be as long as the user wants
    • Helpful for retaining the state of the database for longer period of time

RDS Read Replicas

  • Read replicas helps to scale the read operations
  • We can create up to 5 read replicas
  • These replicas can be within AZ, cross AZ or in different regions
  • The data between the main database and the read replicas is replicated asynchronously => reads are eventually consistent
  • Read replicas can be promoted into their own database
  • Use case for read replicas:
    • Production database is up and running taking on normal load
    • There is a new feature for running some reporting for analytics which may cause slow downs and may overload the database
    • To fix this we can create read replicas for reporting
  • Read replicas are used for SELECT operations (not INSERT, UPDATE, DELETE)
  • Network cost for read replicas:
    • In AWS there is network cost if data goes from one AZ to another
    • In case of cross AZ replication, additional costs may incur because of network traffic
    • To reduce costs, we could have the read replicas in the same AZ

RDS Multi AZ (Disaster Recovery)

  • RDS Multi AZ replication is done using synchronous replication
  • In case of multi AZ configuration we get one DNS name
  • In case of the main database goes down, the traffic is automatically re-routed to the failover database
  • Multi AZ is not used for scaling
  • The read replicas can be set up as Multi AZ for Disaster Recovery

RDS Security

Encryption

  • AWS RDS provides rest encryption: possibility to encrypt the master and read replicas with AWS KMS - AES-256 encryption
    • Encryption has to be defined at the launch time
    • If the master is not encrypted, the read replicas cannot be encrypted
    • Transparent Data Encryption (TDE) is available for Oracle and SQL Server
  • In-flight encryption: uses SSL certificates to encrypt data from client to RDS in flight
    • It is required SSL a trust certificate when connecting to database
    • To enforce SSL:
      • PostgeSQL: rds.force_ssl=1 in the AWS RDS Console (Parameter Groups)
      • MySQL: GRANT USAGE ON *.* To 'user'@'%' REQUIRE SSL;
  • Encrypting RDS backups:
    • Snapshots of un-encrypted RDS databases are un-encrypted
    • Snapshots of encrypted RDS databases are encrypted
    • We can copy an un-encrypted snapshot into an encrypted one
  • Encrypt an un-encrypted RDS database:
    • Create a snapshot
    • Copy the snapshot and enable encryption for the snapshot
    • Restore the database from the encrypted snapshot
    • Migrate application from the old database to the new one and delete the old database

Network Security and IAM

  • Network security:
    • RDS databases are usually deployed within a private subnet
    • RDS security works by leveraging security groups (similar to EC2), they control who can communicate with the database instance
  • Access management:
    • There are IAM policies which help control who can manage an AWS RDS database (through the RDS API)
    • Traditional username/password can be used to login into the database
    • IAM-based authentication can be used to login into MySQL and PostgreSQL
  • IAM authentication:
    • IAM database authentication works with MySQL and PostgreSQL
    • We don't need a password to authenticate, just an authentication token obtained through IAM and RDS API calls
    • The token has a lifetime of 15 minutes
    • Benefits:
      • Network in/out must be encrypted using SSL
      • IAM is used to centrally manage users instead of DB credentials
      • We can manage IAM roles and EC2 instance profiles for easy integration

Security Summary

  • Encryption at rest:
    • It is done only when the database is created
    • To encrypt an existing database, we have create a snapshot, copy it as encrypted, and create an encrypted database from the snapshot
  • Our responsibility:
    • Check the ports/IP/security groups inbound rules
    • Take care of database user creation and permissions or manage them through IAM
    • Create a database with or without public access
    • Ensure parameter groups or DB is configured to only allow SSL connections
  • AWS responsibility:
    • DB patching
    • Underlying OS patching and updates