RDS

Question 1

Basics about RDS

Answer 1

Engines: PostgreSQL, MySQL, MariaDB, Oracle, Microsoft SQL Server

Managed DB: provisioning, backups, patching, monitoring

Launched within a VPC, usually in private subnet, control network
access using security groups (important when using Lambda)

Storage by EBS (gp2 or io1), can increase volume size with auto-scaling

Backups: automated with point-in-time recovery. Backups expire

Snapshots: manual, can make copies of snapshots cross region

RDS Events: get notified via SNS for events (operations, outages…)

It is Multi-AZ, so it has a standby instance for failover. You can also have a read replica which will do reads only

Question 2

RDS Security

Answer 2

• KMS encryption at rest for underlying EBS volumes / snapshots
• Transparent Data Encryption (TDE) for Oracle and SQL Server
• SSL encryption to RDS is possible for all DB (in-flight)
• IAM authentication for MySQL, PostgreSQL and MariaDB
• Authorization still happens within RDS (not in IAM)
• Can copy an un-encrypted RDS snapshot into an encrypted one
• CloudTrail cannot be used to track queries made within RDS

Question 3

RDS for Oracle

Answer 3

Use RDS Backups for backups & restore
to Amazon RDS for Oracle

Use Oracle RMAN (Recovery Manager)
for backups & restore to-non RDS
(RDS not supported)

Real Application Clusters (RAC)
* RDS for Oracle does NOT support RAC
* RAC is working on Oracle on EC2
* Instances because you have full control

• RDS for Oracle supports Transparent Data Encryption (TDE) to encrypt data before it’s written to storage
• DMS works on Oracle RDS

Question 4

RDS for MySQL

Answer 4

You can use the native mysqldump to migrate a MySQL RDS DB to non-RDS

The external MySQL database can run either on-premises in your data center, or on an Amazon EC2 instance

Question 5

RDS Proxy for AWS Lambda

Answer 5

When using Lambda functions with RDS, it
opens and maintains a database connection

This can result in a “TooManyConnections” exception

With RDS Proxy, you no longer need code that handles cleaning up idle connections and managing connection pools

Supports IAM authentication or DB authentication, auto-scaling

The Lambda function must have connectivity to the Proxy (public proxy => public Lambda, private proxy => Lambda in VPC)