Exploring AWS !!

Day 39:

Amazon RDS — Part 2

Previously we’ve learnt about backups, read replicas and disaster recovery strategies of RDS. Today we will dive deeper into some other concepts of RDS.

RDS Security — Encryption:
Encryption at Rest-

• Possibility to encrypt master and read replicas with AWS KMS-AES-256 encryption.
• Encryption has to be defined at launch time.
• If Master is not encrypted, Read Replicas cannot be encrypted.
• Transport Data Encryption (TDE) available for Oracle and SQL server. In Flight Encryption-
• SSL certificate to encrypt data to RDS in flight.
• Provide SSL options with Trust Certificates when connecting to database. To enforce SSL-
• PostgreSQL: rds:force_ssl=1 in the AWS RDS Console (Parameter Groups)
• MySQL: within Database: GRANT USAGE ON . TO ‘mysqluser’@’%’ REQUIRE SSL;

RDS Encryption Operation:
Encrypting RDS Backups:

• Snapshots of unencrypted RDS databases are unencrypted.
• Snapshots of encrypted RDS databases are encrypted.
• Can copy a snapshot into an encrypted one. To encrypt an unencrypted RDS database:
• Create a snapshot of unencrypted snapshot.
• Copy snapshot and enable encryption for snap.
• Restore database from encrypted snapshot.
• Migrate applications to new database and delete old database.

RDS Security — Network and IAM
Network security:

• RDS database are usually deployed in private subnets, not in public.
• RDS security works by leveraging security groups (same concept as for EC2 instance) — it controls which security group/IP can communicate with RDS. Access Management:
• IAM policies helps control who can manage RDS (through RDS API)
• Traditional username and password can be used to login to database.
• IAM based authentication can be used to login into RDS MySQL and PostgreSQL.

RDS IAM Authentication:

• IAM database authentication works with MySQL and PostgreSQL.
• You don’t need password, just need an authentication token through IAM and RDS API calls.
• Authentication token has a lifetime of 15 mins.

Benefits:

• Network in/out must be encrypted by using SSL.
• IAM to centrally manage user instead of database.
• Can leverage IAM roles and EC2 instance profiles for easy integration.

RDS Security Summary:
Encryption at Rest:

• is done only when you first create a database instance.
• or: unencrypted database -> snapshot -> copy snapshot as encrypted -> create database from snapshot. Your Responsibility:
• Check ports/IP/SG inbound rules in database’s security groups.
• In-database user creation and permission or manage through IAM.
• Creating database with or without public access.
• Ensure parameter group or database is configured to only allow SSL connection. AWS Responsibility:
• No SSH access.
• No manual OS patching
• No way to audit underlying instance.