RDS Guide

Instance Creation

# Create DB subnet group aws rds create-db-subnet-group \ --db-subnet-group-name my-subnet-group \ --db-subnet-group-description "My RDS subnet group" \ --subnet-ids subnet-private1a subnet-private1b # Create RDS instance aws rds create-db-instance \ --db-instance-identifier my-postgres \ --db-instance-class db.t3.medium \ --engine postgres \ --engine-version 16.1 \ --master-username admin \ --master-user-password MySecurePass123! \ --allocated-storage 100 \ --storage-type gp3 \ --multi-az \ --db-subnet-group-name my-subnet-group \ --vpc-security-group-ids sg-db \ --backup-retention-period 7 \ --deletion-protection \ --no-publicly-accessible # Wait for instance to be available aws rds wait db-instance-available \ --db-instance-identifier my-postgres

Parameter Groups

# Create custom parameter group aws rds create-db-parameter-group \ --db-parameter-group-name my-pg16-params \ --db-parameter-group-family postgres16 \ --description "Custom PostgreSQL 16 parameters" # Modify parameters aws rds modify-db-parameter-group \ --db-parameter-group-name my-pg16-params \ --parameters \ "ParameterName=max_connections,ParameterValue=200,ApplyMethod=pending-reboot" \ "ParameterName=shared_buffers,ParameterValue={DBInstanceClassMemory/32768},ApplyMethod=pending-reboot" \ "ParameterName=log_min_duration_statement,ParameterValue=1000,ApplyMethod=immediate" # Apply parameter group to instance aws rds modify-db-instance \ --db-instance-identifier my-postgres \ --db-parameter-group-name my-pg16-params \ --apply-immediately

Snapshots & Restore

# Create manual snapshot aws rds create-db-snapshot \ --db-instance-identifier my-postgres \ --db-snapshot-identifier my-postgres-snap-20240101 # List snapshots aws rds describe-db-snapshots \ --db-instance-identifier my-postgres \ --query 'DBSnapshots[*].[DBSnapshotIdentifier,SnapshotCreateTime,Status]' \ --output table # Restore from snapshot to new instance aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier my-postgres-restored \ --db-snapshot-identifier my-postgres-snap-20240101 \ --db-instance-class db.t3.medium # Point-in-time restore aws rds restore-db-instance-to-point-in-time \ --source-db-instance-identifier my-postgres \ --target-db-instance-identifier my-postgres-pit \ --restore-time 2024-01-15T03:30:00Z

Read Replicas

# Create read replica aws rds create-db-instance-read-replica \ --db-instance-identifier my-postgres-read-1 \ --source-db-instance-identifier my-postgres \ --db-instance-class db.t3.medium # Create cross-region read replica aws rds create-db-instance-read-replica \ --db-instance-identifier my-postgres-eu \ --source-db-instance-identifier arn:aws:rds:us-east-1:123456789012:db:my-postgres \ --db-instance-class db.t3.medium \ --region eu-west-1 # Promote read replica to standalone instance aws rds promote-read-replica \ --db-instance-identifier my-postgres-read-1 # Note: Read replicas use asynchronous replication # Multi-AZ standby uses synchronous replication (no read traffic)

Multi-AZ & Failover

# Convert single-AZ to Multi-AZ aws rds modify-db-instance \ --db-instance-identifier my-postgres \ --multi-az \ --apply-immediately # Force failover (for testing) aws rds reboot-db-instance \ --db-instance-identifier my-postgres \ --force-failover # Monitor events aws rds describe-events \ --source-identifier my-postgres \ --source-type db-instance \ --duration 60 # Subscribe to RDS events via SNS aws rds create-event-subscription \ --subscription-name my-alerts \ --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-alerts \ --source-type db-instance \ --event-categories '["failover","failure","maintenance"]'

Encryption & Security

FeatureNotes
Encryption at restEnable at creation with --storage-encrypted; uses KMS
Encrypt unencrypted DBSnapshot → copy with encryption → restore
SSL/TLS in transitDownload RDS CA bundle; set sslmode=verify-full
IAM DB authenticationGenerate token with aws rds generate-db-auth-token
Secrets Manager rotationAuto-rotate credentials without app downtime
Deletion protection--deletion-protection prevents accidental delete