RDS Flashcards
What are the 6 Databases that AWS manages?
- Postgres
- MySQL
- MariaDB
- Oracle
- Microsoft SQL Server
- Aurora (AWS Proprietary DB)
Can Read Replicas be set up as Multi AZ for Disaster Recovery (DR)
Yes
Do Read Replicas cost money for ASYNC replication across Multi AZs
- Yes - it is expensive for read replicas to work across multi AZs.
- It is FREE if read replicas are in the same AZ
T/F - Read Replicas, Reads as eventually consistent
TRUE
What are the type of RDS Encryption
- At rest encryption - encryption must be defined at launch time
- In-flight encryption - SSL certificates to encrypt data to RDS in flight
RDS - what management aspects are you responsible for?
- Check the ports / IP / security group inbound rules in SG DB
- In-database user creation and permissions or manage through IAM
- Creating a DB with or without public access
- Ensure parameter groups or DB is configured to only allow SSL connections
RDS - what management aspects is AWS responsible for?
- Not allow SSH access into DB Instance
- DB Patching
- OS Patching
What are the advantages of using RDS verses deploying on EC2?
- RDS is a managed service
- Automated provisioning
- OS Patching
- Monitoring dashboards
- Read replicas available for improved performance
- Multi AZ setup for disaster recovery
- Scaling capabilities
- Storage backed by EBS
Can you SSH into an AWS RDS instance?
NO
How many Read replicas can you have for RDS?
Up to 5
Describe at rest encryption for RDS instantances
- Can be encrypted with AWS KMS AES-256
- Encryption must be defined at launch time
- If master is not encrypted read replicas can not be encrypted
Describe in-flight encryption for RDS instances
SSL certs are required to encrypt data to RDS in flight
How would you encrypt an un-encrypted RDS database?
- Create a snapshot of the un-encrypted db
- Copy the snapshot and enable encryption for the snapshot
- Restore the DB from the newly encrypted snapshot
- Migrate application to the new db, and delete the old db
Describe main features of Aurora DB
- Automatic fail-over
- Backup and recovery
- Isolation and security
- Industry compliance
- Push button scaling
- Automated patching with zero downtime
- Advanced monitoring
- Routine maintenance
- Backtrack: restore data at any point of time w/o using backups
Describe Aurora DBS secuirty
- Similar to RDS - uses same engines
- Encryption at rest using KMS
- Automated backups, snapshots and replicas are also encrypted
- Encryption in flight using SSL
- Possibility to authenticate using IAM token (same in RDS)
- You are responsible for protecting the instance with security groups
- You can NOT SSH