What is RDS?
Relational Database Service
- Managed by AWS
- SSH not available
- Automated backups, OS patching and provisioning
- Read replicas available
- Multi AZ
- Storage backed by EBS (gp2 or io1)
- no way to audit underlying instance
What are the types of RDS?
- Postgres
- MySQL
- MS SQL Server
- Oracle
- Maria
- Aurora (AWS proprietary)
What are the RDS backup types?
- Daily full backups (during maintenance window)
- Every 5min Transaction log backups
- Backups automatically retained for 7 days (max 35 days)
- DB snapshots (manually triggered by user retained for as long as you want)
What are RDS read replicas?
A copy of a database with read only access (i.e. SELECT)
- up to 5 read replicas per DB
- can be within AZ, Cross AZ, or Cross Region
- Asynchronous replication, so eventually consistent
- can be promoted to their own DB
- cost to replicate across AZs
What are characteristics of Multi-AZ RDS?
- Synchronous replication
- One DNS name for failover standby (High Availability)
- Automatic failover
- Not used for scaling
What kind of encryption is available for RDS?
- At Rest encryption
- In-flight encryption
- Backup/snapshot encryption
What is At Rest encryption?
Ability to encrypt at launch time the master and read replicas with AWS KMS(AES-256)
- master DB must be encrypted before read replicas can be encrypted
- Transparent Data Encryption (TDE) available for Oracle and SQL Server
What is In-flight encryption?
Ability to encrypt the data as it flows into the RDS
- uses SSL certificates to encrypt the data
How are RDS backups encrypted?
Only snapshots of encrypted databases will automatically be encrypted. Un-encrypted snapshots will remain un-encrypted.
- Note: you can copy an un-encrypted snapshot to an encrypted database
What are the steps for encrypting an RDS?
- Create a snapshot of the un-encrypted database
- Copy the snapshot with encryption enabled
- Restore the database from the encrypted snapshot
- Migrate applications to the new database and delete the old one
What are the RDS Security options?
- Encryption
- Network Security (security groups and IP control)
- IAM policies
- IAM-based authentication for PostgreSQL & MySQL only (uses authentication token with life of 15 min)
- No SSH
What are the RDS Security responsibilites?
We are responsible for…
- IP & Port restrictions via security group inbound rules
- Database user creation & permission or manage through IAM
- Public or Private access designation
- parameter groups or only SSL connection configuration
AWS is responsible for…
- Database patching
- OS patching
What is Aurora?
A proprietary AWS database cloud optimized technology
- can have up to 15 read replicas
- failover is instantaneous (High Availability native)
- supports Postgres & MySQL database drivers
- automatically grows in increments of 10GB (max 64TB)
- pay per second, costs 20% more than RDS, but more efficient
- automated patching with zero downtime
- advanced monitoring
What kind of fault tolerance is available for Aurora?
- up to 6 copies of your data across 3 AZs
- Self healing with peer to peer replication
- storage is striped across 100s of volumes
- one instance (master) take writes
- Failover for master in less than 30 seconds
- supports Cross Region Replication
- can restore to any point in time without using backups
What are the Aurora Security options?
- At Rest encryption using KMS
- In-flight encryption
- IAM token authentication
- No SSH
- Security Groups
- Backup/snapshot encryption
What is Global Aurora?
A cross region Aurora database.
- 1 primary region for read/write
- up to 5 secondary regions for read only
- up to 16 read replicas per secondary region
- promoting a secondary region for DR takes less than 1 minute
What is ElastiCache?
In-memory database for read intensive workloads.
- Fully managed by AWS (OS maintenance, optimizations, setup, configuration, monitoring, backups and failover)
- must have an invalidation strategy to make sure only most current data is used
What are the ElastiCache types?
Redis :
- Multi-AZ with auto failover
- read replicas to scale
- Data durability using AOF persistance
- Backup and restore features
Memcached:
- Multi-node for partitioning of data (sharding)
- non persistent
- no backup and restore
- multi-threaded
What are the ElastiCache Security options?
- supports SSL in-flight encryption
- NO IAM authentication
- IAM policies only for API-level security
- Redis Auth token
- Memcached SASL based authentication
- Security Groups
What are the available ElastiCache patterns?
- Lazy Loading where all the data is cached (can become stale)
- Write Through adds or updates data in cache every time data is written to database
- Session store where data is temporarily stored for that session in cache
How can i instantiate an database instance quickly?
Restore from snapshot
What is DynamoDB?
A fully managed, highly available, no SQL database with replication across 3 AZs.
- Made up of tables with a primary key
- Each table can have infinite number of items
- Each item has attributes that can be added over time
- Max item size is 400KB
- Data Types include string, number, binary, boolean, null, list, map, string set, number set, binary set.
- Can coordinate insert, update, delete actions across multiple tables using transactions (up to 10 unique items or 4MB data)
*
What are the advantages of DynamoDB?
- Scales to massive workloads (Provisioned or On Demand)
- Handles millions of request/sec and trillions of rows
- Can use 100s of TB of storage
- Integrated with IAM for security, authorization and admin
- Enable event driven programming with DynamoDB Streams
- Low cost and auto scaling
- Point in time restore (like RDS)
- Can launch a local copy of DB on your own computer for development purposes.
What is RCU/WCU?
RCU is Read Capacity Units, WCU is Write Capacity Units. The are provisioned for the DynamoDB to manage throughput. Throughput can be exceeded temporarily by using ‘burst credits’ earned. If there are no ‘burst credits’ available you will get a ProvisionedThroughputException.
