RDS Security
Storage & DatabaseRDS Security covers protecting relational databases managed by AWS. RDS supports MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora.
Network Isolation
- Deploy in private subnets: never place RDS in public subnets
- Use security groups to restrict access to application servers only
- No Public Accessibility: set
PubliclyAccessibleto false
Encryption
- At Rest: AES-256 encryption using KMS keys; must be enabled at creation (cannot encrypt existing unencrypted instance in-place)
- In Transit: enforce SSL/TLS connections; use
rds.force_sslparameter - Snapshots: encrypted instances produce encrypted snapshots
Authentication
- IAM Database Authentication: use IAM roles instead of database passwords (MySQL, PostgreSQL, Aurora)
- Secrets Manager: automatic rotation of database credentials
Monitoring
- Enable Enhanced Monitoring and Performance Insights
- Enable database audit logging (CloudWatch Logs)
- Use Event Subscriptions for security-relevant notifications
Related Content
Related Terms
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Protecting data as it moves between systems by encrypting the communication channel, typically using TLS/SSL to prevent interception or tampering.
A virtual firewall for EC2 instances and other resources that controls inbound and outbound traffic at the instance level using allow rules.
The practice of securely storing, accessing, and rotating sensitive data like API keys, database passwords, and tokens using services like AWS Secrets Manager.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.