RDS Guide
Instance Creation
# Create DB subnet group
aws rds create-db-subnet-group \
--db-subnet-group-name my-subnet-group \
--db-subnet-group-description "My RDS subnet group" \
--subnet-ids subnet-private1a subnet-private1b
# Create RDS instance
aws rds create-db-instance \
--db-instance-identifier my-postgres \
--db-instance-class db.t3.medium \
--engine postgres \
--engine-version 16.1 \
--master-username admin \
--master-user-password MySecurePass123! \
--allocated-storage 100 \
--storage-type gp3 \
--multi-az \
--db-subnet-group-name my-subnet-group \
--vpc-security-group-ids sg-db \
--backup-retention-period 7 \
--deletion-protection \
--no-publicly-accessible
# Wait for instance to be available
aws rds wait db-instance-available \
--db-instance-identifier my-postgres
Parameter Groups
# Create custom parameter group
aws rds create-db-parameter-group \
--db-parameter-group-name my-pg16-params \
--db-parameter-group-family postgres16 \
--description "Custom PostgreSQL 16 parameters"
# Modify parameters
aws rds modify-db-parameter-group \
--db-parameter-group-name my-pg16-params \
--parameters \
"ParameterName=max_connections,ParameterValue=200,ApplyMethod=pending-reboot" \
"ParameterName=shared_buffers,ParameterValue={DBInstanceClassMemory/32768},ApplyMethod=pending-reboot" \
"ParameterName=log_min_duration_statement,ParameterValue=1000,ApplyMethod=immediate"
# Apply parameter group to instance
aws rds modify-db-instance \
--db-instance-identifier my-postgres \
--db-parameter-group-name my-pg16-params \
--apply-immediately
Snapshots & Restore
# Create manual snapshot
aws rds create-db-snapshot \
--db-instance-identifier my-postgres \
--db-snapshot-identifier my-postgres-snap-20240101
# List snapshots
aws rds describe-db-snapshots \
--db-instance-identifier my-postgres \
--query 'DBSnapshots[*].[DBSnapshotIdentifier,SnapshotCreateTime,Status]' \
--output table
# Restore from snapshot to new instance
aws rds restore-db-instance-from-db-snapshot \
--db-instance-identifier my-postgres-restored \
--db-snapshot-identifier my-postgres-snap-20240101 \
--db-instance-class db.t3.medium
# Point-in-time restore
aws rds restore-db-instance-to-point-in-time \
--source-db-instance-identifier my-postgres \
--target-db-instance-identifier my-postgres-pit \
--restore-time 2024-01-15T03:30:00Z
Read Replicas
# Create read replica
aws rds create-db-instance-read-replica \
--db-instance-identifier my-postgres-read-1 \
--source-db-instance-identifier my-postgres \
--db-instance-class db.t3.medium
# Create cross-region read replica
aws rds create-db-instance-read-replica \
--db-instance-identifier my-postgres-eu \
--source-db-instance-identifier arn:aws:rds:us-east-1:123456789012:db:my-postgres \
--db-instance-class db.t3.medium \
--region eu-west-1
# Promote read replica to standalone instance
aws rds promote-read-replica \
--db-instance-identifier my-postgres-read-1
# Note: Read replicas use asynchronous replication
# Multi-AZ standby uses synchronous replication (no read traffic)
Multi-AZ & Failover
# Convert single-AZ to Multi-AZ
aws rds modify-db-instance \
--db-instance-identifier my-postgres \
--multi-az \
--apply-immediately
# Force failover (for testing)
aws rds reboot-db-instance \
--db-instance-identifier my-postgres \
--force-failover
# Monitor events
aws rds describe-events \
--source-identifier my-postgres \
--source-type db-instance \
--duration 60
# Subscribe to RDS events via SNS
aws rds create-event-subscription \
--subscription-name my-alerts \
--sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-alerts \
--source-type db-instance \
--event-categories '["failover","failure","maintenance"]'
Encryption & Security
| Feature | Notes |
|---|---|
| Encryption at rest | Enable at creation with --storage-encrypted; uses KMS |
| Encrypt unencrypted DB | Snapshot → copy with encryption → restore |
| SSL/TLS in transit | Download RDS CA bundle; set sslmode=verify-full |
| IAM DB authentication | Generate token with aws rds generate-db-auth-token |
| Secrets Manager rotation | Auto-rotate credentials without app downtime |
| Deletion protection | --deletion-protection prevents accidental delete |