# AWS Fundamentals RDS + Aurora + ElastiCache



**vs RDS Databases ports:**

* PostgreSQL: 5432
* MySQL: 3306
* Oracle RDS: 1521
* MSSQL Server: 1433
* MariaDB: 3306 (same as MySQL)
* Aurora: 5432 (if PostgreSQL compatible) or 3306 (if MySQL compatible)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F0kP75MezooSPUKTqhHwO%2Fimage.png?alt=media\&token=547b8f3e-34c8-4a6f-80a3-77bb4b865788)





![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FseCwOJAYn4V8PnRIR21s%2Fimage.png?alt=media\&token=16045502-2c3a-4078-b244-58c05ee4d41e)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FPfp3ZYaF1tDt2hxjCtOI%2Fimage.png?alt=media\&token=07d59c44-8127-460b-a277-d8ddb7d232be)

## <mark style="color:orange;">AWS RDS Overview</mark>&#x20;

**• RDS stands for Relational Database Service**&#x20;

**• It’s a managed DB service for DB use SQL as a query language.**&#x20;

**• It allows you to create databases in the cloud that are managed by AWS**&#x20;

&#x20;       • Postgres&#x20;

&#x20;       • MySQL&#x20;

&#x20;        • MariaDB&#x20;

&#x20;       • Oracle&#x20;

&#x20;       • Microsoft SQL Server&#x20;

&#x20;      • Aurora (AWS Proprietary database)



### <mark style="color:blue;">Advantage over using RDS versus deploying DB on EC2</mark>&#x20;

<mark style="color:green;">**• RDS is a managed service:**</mark>&#x20;

&#x20;      **• Automated provisioning, OS patching**&#x20;

&#x20;      **• Continuous backups and restore to specific timestamp (Point in Time Restore)!**&#x20;

&#x20;      **• Monitoring dashboards**

&#x20;      **• Read replicas for improved read performance**&#x20;

&#x20;      **• Multi AZ setup for DR (Disaster Recovery)**&#x20;

&#x20;      **• Maintenance windows for upgrades**&#x20;

&#x20;     **• Scaling capability (vertical and horizontal)**&#x20;

&#x20;      **• Storage backed by EBS (gp2 or io1)**&#x20;

<mark style="color:green;">**• BUT you can’t SSH into your instances**</mark>

## <mark style="color:orange;">RDS Backups</mark>&#x20;

**• Backups are automatically enabled in RDS**&#x20;

<mark style="color:green;">**• Automated backups:**</mark>&#x20;

&#x20;       • Daily full backup of the database (during the maintenance window)&#x20;

&#x20;       • Transaction logs are backed-up by RDS every 5 minutes&#x20;

&#x20;       • => **ability to restore** to any point in time (from oldest backup to 5 minutes ago)&#x20;

&#x20;       • 7 days retention (can be increased to 35 days)&#x20;

<mark style="color:green;">**• DB Snapshots:**</mark>&#x20;

&#x20;          • Manually triggered by the user&#x20;

&#x20;        • Retention of backup for as long as you want



## <mark style="color:blue;">RDS – Storage Auto Scaling</mark>&#x20;

**• Helps you increase storage on your RDS DB instance dynamically**&#x20;

• When RDS detects you are running out of free database storage, it scales automatically&#x20;

• **Avoid manually scaling your database storage**&#x20;

• You have to set Maximum Storage Threshold (maximum limit for DB storage)

**• Automatically modify storage if:** &#x20;

&#x20;      • Free storage is less than 10% of allocated storage&#x20;

&#x20;     • Low-storage lasts at least 5 minutes&#x20;

&#x20;     • 6 hours have passed since last modification&#x20;

&#x20;     **• Useful for applications with unpredictable workloads**&#x20;

&#x20;   **• Supports all RDS database engines (MariaDB, MySQL, PostgreSQL, SQL Server, Oracle)**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FYxwxAlPyphWEK7W3mtY7%2Fimage.png?alt=media\&token=0dc3bafa-f349-4059-913c-70667218ae0d)

## <mark style="color:orange;">RDS Read Replicas for read scalability</mark>

• Up to 5 Read Replicas&#x20;

• Within AZ, Cross AZ or Cross Region&#x20;

• Replication is ASYNC, so reads are eventually consistent

&#x20;• Replicas can be promoted to their own DB&#x20;

• Applications must update the connection string to leverage read replicas

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FlPaEP2FJWh88ZUu3uFs4%2Fimage.png?alt=media\&token=6046661f-4150-447a-ab4e-528bdce9fff2)

### <mark style="color:blue;">RDS Read Replicas – Use Cases</mark>

• You have a production database that is taking on normal load&#x20;

• You want to run a reporting application to run some analytics&#x20;

• You create a Read Replica to run the new workload there&#x20;

• The production application is unaffected&#x20;

• Read replicas are used for SELECT (=read) only kind of statements (not INSERT, UPDATE, DELETE)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FxRtXHglJRcSF15PnLKG8%2Fimage.png?alt=media\&token=3b1e2d71-1c82-485a-95b3-e699e8bee378)

## <mark style="color:blue;">RDS Read Replicas – Network Cost</mark>

**• In AWS there’s a network cost when data goes from one AZ to another**&#x20;

**• For RDS Read Replicas within the same region, you don’t pay that fee**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FM1negGzrPl6JlsXNJ1L5%2Fimage.png?alt=media\&token=38d719fa-e9c2-46b7-a659-42da05fe0064)

## <mark style="color:orange;">RDS Multi AZ (Disaster Recovery)</mark>

• SYNC replication&#x20;

• One DNS name – automatic app failover to standby&#x20;

**• Increase availability**&#x20;

• Failover in case of loss of AZ, loss of network, instance or storage failure&#x20;

• No manual intervention in apps&#x20;

• Not used for scaling&#x20;

• Multi-AZ replication is free&#x20;

<mark style="color:green;">**• Note:**</mark> <mark style="color:green;">**The Read Replicas be setup as Multi AZ for Disaster Recovery (DR)**</mark>

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F621BGqfyGQIwDOaMxVbV%2Fimage.png?alt=media\&token=252b84cb-16e3-4699-8c00-075b27fd32ed)



## <mark style="color:blue;">RDS – From Single-AZ to Multi-AZ</mark>

**• Zero downtime operation (no need to stop the DB)**&#x20;

**• Just click on “modify” for the database**&#x20;

**• The following happens internally:**&#x20;

&#x20;      • A snapshot is taken&#x20;

&#x20;      • A new DB is restored from the snapshot in a new AZ&#x20;

&#x20;       • Synchronization is established between the two databases

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fy3QytXAPgoMRBVy6adtz%2Fimage.png?alt=media\&token=13c5378d-95b2-49a4-8204-2a9c37a9f3f7)

## <mark style="color:orange;">RDS Security - Encryption</mark>&#x20;

### <mark style="color:green;">• At rest encryption</mark>&#x20;

&#x20;    **• Possibility to encrypt the master & read replicas with AWS KMS - AES-256 encryption**&#x20;

&#x20;     • Encryption has to be defined at launch time&#x20;

&#x20;     **• If the master is not encrypted, the read replicas cannot be encrypted**

&#x20;     **• Transparent Data Encryption (TDE**) available for **Oracle and SQL Server**&#x20;

### <mark style="color:green;">• In-flight encryption</mark>&#x20;

&#x20;    • SSL certificates to encrypt data to RDS in flight&#x20;

&#x20;   • Provide SSL options with trust certificate when connecting to database&#x20;

<mark style="color:red;">**• To enforce SSL:**</mark>&#x20;

&#x20;    **• PostgreSQL:** rds.force\_ssl=1 in the AWS RDS Console (Parameter Groups)&#x20;

&#x20;    **• MySQL:** Within the DB: GRANT USAGE ON _._ TO 'mysqluser'@'%' REQUIRE SSL;

## <mark style="color:blue;">RDS Encryption Operations</mark>&#x20;

### <mark style="color:green;">• Encrypting RDS backups</mark>&#x20;

&#x20;    • Snapshots of un-encrypted RDS databases are un-encrypted&#x20;

&#x20;    • Snapshots of encrypted RDS databases are encrypted&#x20;

&#x20;    • Can copy a snapshot into an encrypted one&#x20;

### <mark style="color:green;">• To encrypt an un-encrypted RDS database:</mark>&#x20;

&#x20;   **• Create a snapshot of the un-encrypted database**&#x20;

&#x20;     **• Copy the snapshot and enable encryption for the snapshot**&#x20;

&#x20;      • **Restore the database from the encrypted snapshot**&#x20;

&#x20;      • **Migrate applications to the new database, and delete the old database**



## <mark style="color:orange;">RDS Security – Network & IAM</mark>&#x20;

### <mark style="color:green;">• Network Security</mark>&#x20;

&#x20;   • RDS databases are usually deployed within a **private subnet, not in a public one**&#x20;

&#x20;  • RDS security works by leveraging security groups (the same concept as for EC2 instances) – it controls **which IP / security group can communicate with RDS**&#x20;

### <mark style="color:green;">• Access Management</mark>

&#x20;**• IAM policies help control who can manage AWS RDS (through the RDS API)**&#x20;

• Traditional **Username and Password** can be used to login into the database&#x20;

• **IAM-based authentication** can be used to login into **RDS MySQL & PostgreSQL**



## **RDS - IAM Authentication**&#x20;

&#x20;    • IAM database authentication works with **MySQL and PostgreSQL**&#x20;

&#x20;    • You don’t need a password, just an **authentication token obtained through IAM & RDS API calls**&#x20;

&#x20;    • **Auth token has a lifetime of 15 minutes**&#x20;

### • Benefits:&#x20;

&#x20;     • Network in/out must be encrypted using SSL&#x20;

&#x20;    • IAM to centrally manage users instead of DB&#x20;

&#x20;    **• Can leverage IAM Roles and EC2 Instance profiles for easy integration**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FZVvZkjf5z65efvdHP5nB%2Fimage.png?alt=media\&token=d202f95a-31db-42a0-888d-5659e1a656a7)

### <mark style="color:blue;">RDS Security – Summary</mark>&#x20;

### • Encryption at rest:&#x20;

&#x20;     • Is done only when you first create the DB instance&#x20;

&#x20;     **• or: unencrypted DB => snapshot => copy snapshot as encrypted => create DB from snapshot**&#x20;

### • Your responsibility:&#x20;

&#x20;      • Check the ports / IP / security group inbound rules in DB’s SG&#x20;

&#x20;      • In-database user creation and permissions or manage through IAM&#x20;

&#x20;     • Creating a database with or without public access&#x20;

&#x20;     • Ensure parameter groups or DB is configured to only allow SSL connections&#x20;

### **• AWS responsibility:**&#x20;

&#x20;      • No SSH access&#x20;

&#x20;     • No manual DB patching&#x20;

&#x20;     • No manual OS patching&#x20;

&#x20;    • No way to audit the underlying instance







## <mark style="color:orange;">Amazon Aurora</mark>&#x20;

**• Aurora is a proprietary technology from AWS (not open sourced)**&#x20;

**• Postgres and MySQL are both supported as Aurora DB** (that means your drivers will work as if Aurora was a Postgres or MySQL database)

&#x20;• Aurora is “AWS cloud optimized” and claims **5x performance** improvement over **MySQL on RDS,** over **3x the performance of Postgres on RDS**&#x20;

**• Aurora storage automatically grows in increments of 10GB, up to 128 TB.**&#x20;

**• Aurora can have 15 replicas while MySQL has 5,** and the replication process is faster (sub 10 ms replica lag)&#x20;

• Failover in Aurora is instantaneous. It’s HA (High Availability) native.&#x20;

**• Aurora costs more than RDS (20% more) – but is more efficient**



### Aurora High Availability and Read Scaling&#x20;

**• 6 copies of your data across 3 AZ:**&#x20;

&#x20;      • 4 copies out of 6 needed for writes&#x20;

&#x20;    • 3 copies out of 6 need for reads&#x20;

&#x20;    • Self healing with peer-to-peer replication&#x20;

&#x20;    • Storage is striped across 100s of volumes&#x20;

**• One Aurora Instance takes writes (master)**&#x20;

**• Automated failover for master in less than 30 second**s&#x20;

• Master + up to 15 Aurora Read Replicas serve reads&#x20;

**• Support for Cross Region Replication**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fe25Z1MSlOxlZMozer621%2Fimage.png?alt=media\&token=4c4eacfa-a4af-48d5-ba4d-f220871af16d)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FQ2ggeZV384Hb6FLqn29e%2Fimage.png?alt=media\&token=92e583f3-25ce-4ad3-99e0-27ce640c8005)

## Features of Aurora&#x20;

• Automatic fail-over&#x20;

• Backup and Recovery&#x20;

• Isolation and security&#x20;

• Industry compliance&#x20;

• Push-button scaling&#x20;

• Automated Patching with Zero Downtime&#x20;

• Advanced Monitoring&#x20;

• Routine Maintenance&#x20;

• Backtrack: restore data at any point of time without using backups



## Aurora Security&#x20;

&#x20;   • Similar to RDS because uses the same engines&#x20;

&#x20;  **• Encryption at rest using KMS**&#x20;

&#x20;   **• Automated backups, snapshots and replicas are also encrypted**&#x20;

&#x20;    **• Encryption in flight using SSL (same process as MySQL or Postgres)**&#x20;

**• Possibility to authenticate using IAM token (same method as RDS)**&#x20;

**• You are responsible for protecting the instance with security groups**&#x20;

**• You can’t SSH**

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FXiyRt40Lf3wpV0XiJUpf%2Fimage.png?alt=media\&token=d6f2cf04-f29d-42c5-a698-92054d875e82)



## Aurora – Custom Endpoints

&#x20;• Define a subset of Aurora Instances as a Custom Endpoint&#x20;

• Example: Run analytical queries on specific replicas&#x20;

• The Reader Endpoint is generally not used after defining Custom Endpoints

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F7f20AerEx7KuGyPw1kQj%2Fimage.png?alt=media\&token=2bafd9d2-f71a-4573-be57-65576a92be99)



## Aurora Serverless&#x20;

&#x20;• Automated database instantiation and auto

* scaling based on actual usage&#x20;
* • Good for infrequent, intermittent or unpredictable workloads&#x20;
* • No capacity planning needed&#x20;
* • Pay per second, can be more cost -effective
*

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F0Rx7ICAjuhAQp5pZuWsZ%2Fimage.png?alt=media\&token=267b63f6-e210-4ffa-8de4-ec11958b9b73)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FmugGehlMn4TwZXikdEqt%2Fimage.png?alt=media\&token=d4e2e0d2-a1ba-462b-9141-04b6ea40773b)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2F7N6KNYXmiejabXJ34Iwi%2Fimage.png?alt=media\&token=492adccf-d5a5-4131-b96c-e9edff15d58a)



![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FaII2nlpEb6P8InJNPirq%2Fimage.png?alt=media\&token=dde7152b-d8e7-4abd-bfdf-a33334d4bea4)

## <mark style="color:orange;">Amazon ElastiCache Overview</mark>&#x20;

• The same way RDS is to get managed Relational Databases…&#x20;

• ElastiCache is to get managed Redis or Memcached&#x20;

• Caches are in-memory databases with really high performance, low latency&#x20;

• Helps reduce load off of databases for read intensive workloads&#x20;

• Helps make your application stateless&#x20;

• AWS takes care of OS maintenance / patching, optimizations, setup, configuration, monitoring, failure recovery and backups&#x20;

• Using ElastiCache involves heavy application code changes



## ElastiCache Solution Architecture - DB Cache

• Applications queries ElastiCache, if not available, get from RDS and store in ElastiCache.&#x20;

• Helps relieve load in RDS&#x20;

• Cache must have an invalidation strategy to make sure only the most current data is used in there.

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fpf5qlEe4dNBS5ELKYvEZ%2Fimage.png?alt=media\&token=2e0c93c1-f0cf-4495-b159-614cf1bfe8fb)

![
](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FPbyYrt7pWnR1I9vSfA69%2Fimage.png?alt=media\&token=be283b58-43d3-430d-9818-6fd1e02ee87a)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FbDs9A9KmFwNj6PhHfu4M%2Fimage.png?alt=media\&token=3f819317-75f9-4448-a038-739e7f58a7cc)



## ElastiCache – Cache Security

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FPednlENIr0MuDTOjMrZY%2Fimage.png?alt=media\&token=494debe5-ac77-4e2b-b742-50528e8d709e)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FSlWWMUhAGQF5G1m1zsNG%2Fimage.png?alt=media\&token=66acb105-426f-4c6e-abfa-e483dbcc2171)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Ffy0cHudRwjFi0aVXETWy%2Fimage.png?alt=media\&token=25dd72c9-5b72-441d-aa8c-247dfe822451)
