aws-rds

aws-rds Best Practices

This guide outlines the definitive best practices for interacting with and managing AWS RDS instances. Adhere to these guidelines to ensure your database operations are secure, performant, and maintainable.

1. Security Best Practices

Security is paramount. Always assume your database is a target.

1.1. Manage Credentials with AWS Secrets Manager

Never hardcode database credentials or store them in environment variables directly. Use AWS Secrets Manager with automatic rotation enabled.

❌ BAD:

# app.py
DB_USER = os.getenv("DB_USER")
DB_PASS = os.getenv("DB_PASS")
conn = psycopg2.connect(user=DB_USER, password=DB_PASS, host=DB_HOST)

✅ GOOD:

import boto3
import json

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# app.py
secret = get_secret("your-rds-db-credentials")
DB_USER = secret['username']
DB_PASS = secret['password']
DB_HOST = secret['host']
conn = psycopg2.connect(user=DB_USER, password=DB_PASS, host=DB_HOST)

Context: Secrets Manager handles rotation, encryption, and secure retrieval, significantly reducing the risk of credential compromise.

1.2. Enforce Least Privilege with IAM

Control access to RDS API actions (create, modify, delete clusters, security groups, parameter groups) using IAM identities, not the root account. Grant only the minimum permissions required. Organize permissions with IAM groups.

❌ BAD:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "rds:*",
            "Resource": "*"
        }
    ]
}

Context: This grants full access to all RDS resources, a massive security risk.

✅ GOOD:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:Connect"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:ModifyDBInstance",
                "rds:DeleteDBInstance"
            ],
            "Resource": "arn:aws:rds:REGION:ACCOUNT_ID:db:my-specific-app-db"
        }
    ]
}

Context: This policy grants read-only access to all RDS resources and specific modification/deletion rights to a single, named DB instance.