AWS RDS Security

• AWS RDS Security provides multiple features
  • DB instance can be hosted in a VPC for the greatest possible network access control.
  • IAM policies can be used to assign permissions that determine who is allowed to manage RDS resources.
  • Security groups allow control of what IP addresses or EC2 instances can connect to the databases on a DB instance.
  • RDS supports encryption in transit using SSL/TLS connections
  • RDS supports encryption at rest to secure instances and snapshots at rest.
  • Network encryption and transparent data encryption (TDE) with Oracle DB instances
  • Authentication can be implemented using Password, Kerberos, and IAM database authentication.
  • Database Activity Streams provide near real-time monitoring and auditing of database activity.
  • RDS Proxy provides connection pooling with IAM authentication and Secrets Manager integration.

RDS IAM and Access Control

• IAM can be used to control which RDS operations each individual user has permission to call.
• IAM policies can grant or deny access to specific RDS resources based on conditions such as tags, IP addresses, or VPC.
• Service-linked roles allow RDS to make calls to other AWS services on your behalf.

RDS Authentication Methods

• RDS supports multiple authentication methods:
  • Password authentication – Traditional database username/password.
  • IAM database authentication – Token-based authentication using IAM credentials (MySQL, PostgreSQL, MariaDB).
  • Kerberos authentication – Single sign-on using Microsoft Active Directory. Supported for Db2, PostgreSQL, MySQL, Oracle, and SQL Server.
• Kerberos authentication integrates with AWS Managed Microsoft AD or on-premises AD via forest trust for centralized authentication.

RDS Encryption at Rest

• RDS encrypted instances use the industry-standard AES-256 encryption algorithm to encrypt data on the server that hosts the RDS instance.
• RDS handles authentication of access and decryption of the data with a minimal impact on performance, and with no need to modify the database client applications
• Data at Rest Encryption
  • can be enabled on RDS instances to encrypt the underlying storage
  • encryption keys are managed by KMS
  • can be enabled only during instance creation
  • once enabled, the encryption keys cannot be changed
  • if the key is lost, the DB can only be restored from the backup
  • supports both AWS managed keys and customer managed keys (CMKs)
  • supports multi-Region KMS keys for cross-region snapshot copy and disaster recovery scenarios
• Once encryption is enabled for an RDS instance,
  • logs are encrypted
  • snapshots are encrypted
  • automated backups are encrypted
  • read replicas are encrypted
• Encrypted snapshots can be copied to another region by specifying a KMS key valid in the destination AWS Region. It can be a Region-specific KMS key, or a multi-Region key.
• Cross-Region and Cross-Account Snapshot Copy (Sep 2025) – RDS now supports copying snapshots across Regions and accounts directly in a single step, without performing it sequentially as two separate copies.
• RDS DB Snapshot considerations
  • DB snapshot encrypted using a KMS encryption key can be copied
  • Copying an encrypted DB snapshot results in an encrypted copy of the DB snapshot
  • When copying, the DB snapshot can either be encrypted with the same KMS encryption key as the original DB snapshot, or a different KMS encryption key to encrypt the copy of the DB snapshot.
  • An unencrypted DB snapshot can be copied to an encrypted snapshot, to add encryption to a previously unencrypted DB instance.
  • Encrypted snapshot can be restored only to an encrypted DB instance
  • If a KMS encryption key is specified when restoring from an unencrypted DB cluster snapshot, the restored DB cluster is encrypted using the specified KMS encryption key
  • Copying an encrypted snapshot shared from another AWS account requires access to the KMS encryption key used to encrypt the DB snapshot.
• Transparent Data Encryption (TDE)
  • Automatically encrypts the data before it is written to the underlying storage device and decrypts when it is read from the storage device
  • is supported by Oracle and SQL Server
    • Oracle requires key storage outside of the KMS and integrates with CloudHSM for this
    • SQL Server requires a key but is managed by RDS

RDS Encryption in Transit – SSL/TLS

• Encrypt connections using SSL/TLS for data in transit between the applications and the DB instance
• RDS creates an SSL certificate and installs the certificate on the DB instance when RDS provisions the instance.
• SSL certificates are signed by a certificate authority. SSL certificate includes the DB instance endpoint as the Common Name (CN) for the SSL certificate to guard against spoofing attacks
• While SSL offers security benefits, be aware that SSL/TLS encryption is a compute-intensive operation and will increase the latency of the database connection.
• For encrypted and unencrypted DB instances, data that is in transit between the source and the read replicas is encrypted, even when replicating across AWS Regions.
• Certificate Authority (CA) Updates
  • The older rds-ca-2019 certificates expired in August 2024.
  • AWS introduced new CA certificates in December 2022:
    • rds-ca-rsa2048-g1 – RSA 2048-bit key, valid for 40 years (default for new instances since January 2024)
    • rds-ca-rsa4096-g1 – RSA 4096-bit key, valid for 100 years
    • rds-ca-ecc384-g1 – ECC 384-bit key, valid for 100 years
  • Using the new CA certificates, Amazon RDS manages automatic rotation of the DB server certificate before it expires.
  • New DB instances created after January 26, 2024 use rds-ca-rsa2048-g1 by default.
• RDS supports enforcing SSL/TLS connections using parameter groups (e.g., rds.force_ssl = 1 for PostgreSQL, require_secure_transport = ON for MySQL).

IAM Database Authentication

• IAM database authentication works with MySQL, PostgreSQL, and MariaDB.
• IAM database authentication prevents the need to store static user credentials in the database because authentication is managed externally using IAM.
• Authorization still happens within RDS (not IAM).
• IAM database authentication does not require a password but needs an authentication token
• An authentication token is a unique string of characters that RDS generates on request.
• Authentication tokens are generated using AWS Signature Version 4.
• Each Authentication token has a lifetime of 15 minutes
• IAM database authentication provides the following benefits:
  • Network traffic to and from the database is encrypted using SSL/TLS.
  • Helps centrally manage access to the database resources, instead of managing access individually on each DB instance.
  • Enables using IAM Roles to access the database instead of a password, for greater security.
• Enhanced Observability (Feb 2025) – RDS IAM DB Authentication now provides metrics and logs for improved troubleshooting:
  • CloudWatch metrics for IAM DB Auth connection attempts, successes, and failures.
  • IAM DB Auth error logs can be exported to CloudWatch Logs for investigation and resolution of authentication issues.

RDS Proxy Security

• RDS Proxy is a fully managed, highly available database proxy that makes applications more scalable, resilient, and secure.
• RDS Proxy sits between the application and the database, pooling and sharing established database connections.
• Security features of RDS Proxy:
  • IAM Authentication – Enforces IAM authentication for client-to-proxy connections, eliminating the need for database credentials in application code.
  • Secrets Manager Integration – Proxy retrieves database credentials from AWS Secrets Manager, and you never need to expose credentials to your application.
  • TLS/SSL Enforcement – Supports encrypted connections between client and proxy, and between proxy and database.
  • VPC Security – RDS Proxy runs within your VPC and can be restricted using security groups.
• End-to-End IAM Authentication (Sep 2025) – RDS Proxy now supports end-to-end IAM authentication where both client-to-proxy and proxy-to-database connections use IAM authentication, providing a fully passwordless database access solution.
• RDS Proxy automatically handles failover, routing requests to the new primary instance without disrupting application connections.

Database Activity Streams

• Database Activity Streams provide a near real-time stream of database activity for monitoring and auditing.
• Supported for RDS for Oracle and RDS for SQL Server (also Aurora PostgreSQL and Aurora MySQL).
• How it works:
  • RDS pushes database activity events to an Amazon Kinesis Data Stream in near real time.
  • The Kinesis stream is created automatically when enabling the feature.
  • From Kinesis, configure services like Amazon Data Firehose and Lambda to consume, store, and analyze the data.
• Key benefits:
  • Separation of Duties – DBAs cannot access or modify the activity stream; encryption is managed via KMS keys controlled by security teams.
  • Compliance – Helps meet regulatory and compliance requirements for database auditing (SOX, PCI, HIPAA).
  • Integration – Works with partner security tools like IBM Guardium, Imperva, and McAfee for automated alerting.
• Operates in asynchronous mode – database activity is recorded without impacting database performance (with a small delay).
• Use of Database Activity Streams is free; you pay only for the underlying Kinesis data stream.

RDS Security Groups

• Security groups control the access that traffic has in and out of a DB instance
• VPC security groups act like a firewall controlling network access to your DB instance.
• VPC security groups can be configured and associated with the DB instance to allow access from an IP address range, port, or EC2 security group
• Database security groups default to a “deny all” access mode and customers must specifically authorize network ingress.
• RDS supports dual-stack mode (IPv4 and IPv6) for DB instances in VPCs, including publicly accessible databases (Oct 2025 expansion).

RDS Secrets Manager Integration

• RDS supports AWS Secrets Manager to manage and automatically rotate database credentials.
• Native RDS Integration with Secrets Manager (2023+)
  • RDS offers built-in integration where Amazon RDS manages the master database credentials in Secrets Manager automatically.
  • When enabled, RDS generates the password, stores it as an encrypted managed secret, and rotates it automatically on a configurable schedule.
  • You never see or manage the master password directly.
  • Can be enabled during instance creation or later by modifying the instance.
  • The managed secret is encrypted with a KMS key you own and control.
• Custom Secrets Manager rotation (for non-master credentials):
  • Uses a Lambda function to rotate credentials.
  • Built-in rotation templates for MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Db2.
  • Supports single-user and multi-user rotation strategies.
• Secrets Manager benefits:
  • Rotate secrets safely without disrupting applications.
  • Manage secrets centrally with fine-grained IAM policies.
  • Encrypt secrets with KMS keys you own and control.
  • Audit access via CloudTrail integration.
  • Pay as you go – per secret stored and API calls made.

Master User Account Privileges

• When you create a new DB instance, the default master user that is used gets certain privileges for that DB instance
• Subsequently, other users with permissions can be created.
• Master user credentials can now be managed by AWS Secrets Manager for improved security (no direct password management).

Event Notification

• Event notifications can be configured for important events that occur on the DB instance
• Notifications of a variety of important events that can occur on the RDS instance, such as whether the instance was shut down, a backup was started, a failover occurred, the security group was changed, or your storage space is low can be received
• RDS sends event notifications via Amazon SNS, and can trigger Lambda functions or other automated responses.

RDS Encrypted DB Instances Limitations

• RDS Encryption can be enabled only during the creation of an RDS DB instance, not after the DB instance is created.
• DB instances that are encrypted can’t be modified to disable encryption.
• Encrypted snapshot of an unencrypted DB instance cannot be created.
• An unencrypted backup or snapshot can’t be restored to an encrypted DB instance.
• An unencrypted DB instance or an unencrypted read replica of an encrypted DB instance can’t have an encrypted read replica.
• DB snapshot of an encrypted DB instance must be encrypted using the same KMS key as the DB instance.
• Encrypted read replicas must be encrypted with the same KMS key as the source DB instance when both are in the same AWS Region.
• For encrypting an unencrypted RDS database, the following approaches can be used:
  • Using Snapshots (requires downtime):
    • Create a DB snapshot of the DB instance, which would be unencrypted.
    • Copy the unencrypted DB snapshot to an encrypted snapshot.
    • Restore a DB instance from the encrypted snapshot, which would be an encrypted DB instance.
  • Using AWS DMS (minimal to no downtime): Use AWS Database Migration Service (AWS DMS) to migrate and continuously replicate the data so that the cutover to the new, encrypted database is seamless.

RDS API with Interface Endpoints (AWS PrivateLink)

• AWS PrivateLink enables you to privately access RDS API operations without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.
• DB instances in the VPC don’t need public IP addresses to communicate with RDS API endpoints to launch, modify, or terminate DB instances.
• DB instances also don’t need public IP addresses to use any of the available RDS API operations.
• Traffic between the VPC and RDS doesn’t leave the Amazon network.

AWS Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

1. Can I encrypt connections between my application and my DB Instance using SSL?
   1. No
   2. Yes
   3. Only in VPC
   4. Only in certain regions
2. Which of these configuration or deployment practices is a security risk for RDS?
   1. Storing SQL function code in plaintext
   2. Non-Multi-AZ RDS instance
   3. Having RDS and EC2 instances exist in the same subnet
   4. RDS in a public subnet (Making RDS accessible to the public internet in a public subnet poses a security risk, by making your database directly addressable and spammable. DB instances deployed within a VPC can be configured to be accessible from the Internet or from EC2 instances outside the VPC. If a VPC security group specifies a port access such as TCP port 22, you would not be able to access the DB instance because the firewall for the DB instance provides access only via the IP addresses specified by the DB security groups the instance is a member of and the port defined when the DB instance was created. Refer link)
3. A company needs to encrypt an existing unencrypted RDS database with minimal downtime. Which approach should they use?
   1. Enable encryption on the existing instance via the console
   2. Create an unencrypted snapshot, copy it as encrypted, and restore
   3. Use AWS DMS to migrate data to a new encrypted RDS instance (AWS DMS enables continuous replication to the encrypted target, minimizing downtime during cutover. The snapshot approach requires downtime during restore.)
   4. Modify the DB instance to add a KMS key
4. A security team requires near real-time auditing of all database activity on an RDS Oracle instance, with separation of duties ensuring DBAs cannot tamper with audit records. Which feature should they use?
   1. CloudTrail data events for RDS
   2. RDS Enhanced Monitoring
   3. Database Activity Streams (Database Activity Streams push activity to a Kinesis stream encrypted with a KMS key controlled by security teams, ensuring DBAs cannot access or modify audit records.)
   4. RDS Performance Insights
5. Which authentication methods does Amazon RDS support? (Choose THREE)
   1. Password authentication
   2. IAM database authentication
   3. Kerberos authentication with Active Directory
   4. SAML-based authentication
   5. OAuth 2.0 authentication
6. A company wants to eliminate database passwords entirely for their serverless application connecting to RDS PostgreSQL through RDS Proxy. Which approach achieves this?
   1. Store credentials in environment variables
   2. Use Secrets Manager integration only
   3. Configure RDS Proxy with end-to-end IAM authentication (Since September 2025, RDS Proxy supports end-to-end IAM authentication where both client-to-proxy and proxy-to-database connections use IAM, providing a fully passwordless solution.)
   4. Use Lambda authorizers with RDS
7. An organization needs to automatically manage and rotate their RDS master user password without using Lambda functions. Which solution requires the least operational effort?
   1. Create a Secrets Manager secret and configure Lambda rotation
   2. Enable the native RDS integration with Secrets Manager to manage the master user password (RDS natively manages the master password in Secrets Manager including automatic rotation, without requiring custom Lambda functions.)
   3. Use IAM database authentication instead of passwords
   4. Store the password in Systems Manager Parameter Store with rotation
8. After the rds-ca-2019 certificate expired in August 2024, which certificate authority should new RDS instances use by default?
   1. rds-ca-2019
   2. rds-ca-rsa2048-g1 (New instances created after January 26, 2024 use rds-ca-rsa2048-g1 by default, which is valid for 40 years.)
   3. rds-ca-rsa4096-g1
   4. rds-ca-ecc384-g1

📖 Related: AWS RDS Backup, Snapshots & Restore – Complete Guide

References

• AWS RDS User Guide – Security
• RDS Encryption at Rest
• Using SSL/TLS to Encrypt a Connection
• IAM Database Authentication
• Database Activity Streams
• Amazon RDS Proxy
• SSL/TLS Certificate Rotation