aws-rds

AWS RDS

Skill para configurar Amazon RDS y Aurora: engines (PostgreSQL, MySQL), Multi-AZ, read replicas, backups, cifrado, IAM auth, parameter groups, Secrets Manager y mejores prácticas de seguridad y rendimiento.

Principios fundamentales

• Multi-AZ habilitado en producción. Sin excepciones.
• Cifrado en reposo (KMS) y en tránsito (SSL/TLS) obligatorio.
• Credenciales en Secrets Manager con rotación automática. Nunca en código o variables de entorno planas.
• Backups automáticos habilitados con retención mínima de 7 días (35 en producción).
• Subnet groups privados. RDS nunca accesible desde internet.

Instancia RDS segura (CDK)

const db = new rds.DatabaseInstance(this, 'Database', {
  engine: rds.DatabaseInstanceEngine.postgres({
    version: rds.PostgresEngineVersion.VER_16,
  }),
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MEDIUM),
  vpc,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
  multiAz: true,
  storageEncrypted: true,
  credentials: rds.Credentials.fromGeneratedSecret('dbadmin'),
  backupRetention: cdk.Duration.days(35),
  deletionProtection: true,
  removalPolicy: cdk.RemovalPolicy.RETAIN,
  monitoringInterval: cdk.Duration.seconds(60),
});

Aurora Serverless v2 (CDK)

const cluster = new rds.DatabaseCluster(this, 'AuroraCluster', {
  engine: rds.DatabaseClusterEngine.auroraPostgres({
    version: rds.AuroraPostgresEngineVersion.VER_16_1,
  }),
  serverlessV2MinCapacity: 0.5,
  serverlessV2MaxCapacity: 8,
  writer: rds.ClusterInstance.serverlessV2('writer'),
  readers: [
    rds.ClusterInstance.serverlessV2('reader', { scaleWithWriter: true }),
  ],
  vpc,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
  credentials: rds.Credentials.fromGeneratedSecret('dbadmin'),
  storageEncrypted: true,
  backupRetention: cdk.Duration.days(35),
  deletionProtection: true,
  removalPolicy: cdk.RemovalPolicy.RETAIN,
});

Conexión desde Lambda

// Usar RDS Proxy para connection pooling
const proxy = new rds.DatabaseProxy(this, 'Proxy', {
  proxyTarget: rds.ProxyTarget.fromInstance(db),
  secrets: [db.secret!],
  vpc,
  requireTLS: true,
});

// En el Lambda handler
import { RDSDataClient, ExecuteStatementCommand } from '@aws-sdk/client-rds-data';

const rdsData = new RDSDataClient({});

const result = await rdsData.send(new ExecuteStatementCommand({
  resourceArn: process.env.DB_CLUSTER_ARN,
  secretArn: process.env.DB_SECRET_ARN,
  database: 'mydb',
  sql: 'SELECT * FROM orders WHERE user_id = :userId',
  parameters: [{ name: 'userId', value: { stringValue: userId } }],
}));