RDS (with Aurora and ElastiCache) — Cheat Sheet (DVA-C02)
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/rds-guide.md#changed-vs-older-material) · explanations and examples: notes/rds-guide.md.
RDS fundamentals and storage auto scaling
| Topic | Current facts | Memory hook |
|---|---|---|
| Engines | Db2, MariaDB, SQL Server, MySQL, Oracle, PostgreSQL; Aurora (MySQL/PostgreSQL-compatible) has its own architecture | Six engines + Aurora |
| Host access | No SSH on RDS; RDS Custom (Oracle and SQL Server only) gives OS access | Custom = keys to the host |
| Storage autoscaling switch | On when --max-allocated-storage > allocated storage; equal = off; applies immediately, no downtime |
Set a ceiling, get autoscaling |
| ⚠️ Autoscaling trigger | Free space ≤ 10 % for ≥ 5 min, previous optimization finished, fewer than 4 storage modifications in 24 h | 10 % · 5 min · < 4 per day |
| Autoscaling increment | Largest of 10 GiB, 10 % of allocated, or predicted growth for the next 7 h | |
| Threshold rule | Ceiling ≥ 10 % above allocated (≥ 26 % recommended); otherwise Invalid max storage size |
|
| Shrinking storage | Never possible in place; use blue/green with less storage (turn off an RDS-managed master password first) or a new instance | Storage only grows |
| Maximum storage | 64 TiB per instance (Db2, MariaDB, MySQL, PostgreSQL); Oracle and SQL Server 256 TiB with up to 3 additional volumes | |
| Aurora and autoscaling | No MaxAllocatedStorage: the Aurora cluster volume grows by itself |
|
| Connection limit | max_connections scales with instance memory; MySQL db.t3.micro ≈ 60 |
|
| Connection errors | MySQL 1040 Too many connections; PostgreSQL FATAL: sorry, too many clients already → RDS Proxy or pooling |
|
| Default ports | MySQL/MariaDB 3306 · PostgreSQL 5432 · Oracle 1521 · SQL Server 1433 · Db2 50000 | |
| Stopped instance | Restarts automatically after 7 days; storage and backups still billed | Stop is a 7-day pause |
| Enhanced Monitoring | MonitoringInterval 1, 5, 10, 15, 30 or 60 s (0 = off); needs a monitoring role |
|
| ⚠️ Database load analysis | CloudWatch Database Insights; Performance Insights console reached end of life 2025-11-30 |
Read replicas
| Topic | Current facts | Memory hook |
|---|---|---|
| Maximum replicas | 15 per source (MySQL, MariaDB, PostgreSQL, Oracle, SQL Server); RDS for Db2: 3 | |
| Replication | Asynchronous → reads can be stale; ReplicaLag metric in seconds |
Replica = maybe yesterday's news |
| Endpoints | Every RDS replica has its own endpoint; the application chooses where reads go | |
| Prerequisite | Source backup retention ≠ 0 (also for a replica that feeds another replica); no RDS-managed master password on the source (except SQL Server, Db2) | No backups, no replicas |
| Writable replicas | Only MySQL and MariaDB (read_only = 0) |
|
| Data transfer | Same-Region replication free; cross-Region replication charged | Cross a Region, pay the toll |
| Cross-Region creation | Run in the destination Region with the source ARN; --kms-key-id from the destination Region |
|
| Encryption | Replica encryption state must match the source | |
| Promotion | promote-read-replica: reboot, standalone and writable, irreversible |
One-way door |
| Multi-AZ replica | A replica can have its own synchronous standby | |
| Automatic failover to replica | None: promotion is manual |
Multi AZ deployments and failover
| Topic | Current facts | Memory hook |
|---|---|---|
| Multi-AZ DB instance | One synchronous standby in another AZ, not readable, failover 60–120 s | Standby = spare tyre |
| ⚠️ Multi-AZ DB cluster | Writer + 2 readable readers in 3 AZs, semisynchronous, failover typically < 35 s, reader endpoint (MySQL, PostgreSQL) | |
| After failover | Same endpoint DNS name; existing connections drop → reconnect with retries | Same name, new IP |
| JVM DNS cache | Set networkaddress.cache.ttl ≤ 60 s |
|
| Test failover | reboot-db-instance --force-failover (instance) · failover-db-cluster (cluster) |
|
| Convert to Multi-AZ | modify-db-instance --multi-az: snapshot-built standby, no downtime, write latency can rise |
|
| Failover alerts | RDS event category failover → SNS or EventBridge |
|
| Multi-AZ replication cost | Cross-AZ replication traffic is free | |
| Region outage | Multi-AZ doesn't help → cross-Region replica or Aurora Global Database | |
| Blue/green deployment | Synchronized green copy; switchover typically < 1 min, no data loss, endpoints move to green | |
| Blue/green limits | Not with RDS-managed master passwords in Secrets Manager, Multi-AZ DB clusters, cascading or cross-Region replicas, or CloudFormation |
Aurora storage endpoints and replicas
| Topic | Current facts | Memory hook |
|---|---|---|
| Storage quorum | 6 copies across 3 AZs; writes need 4, reads need 3 | 6-4-3 |
| ⚠️ Maximum cluster volume | 256 TiB (Aurora MySQL 3.10+, Aurora PostgreSQL 15.13+/16.9+/17.5+); 128 TiB on older versions | |
| Replicas | Up to 15, sharing the cluster volume | |
| ⚠️ Replica lag | Usually much less than 100 ms (AuroraReplicaLag, milliseconds) |
|
| ⚠️ Failover time | With a replica < 60 s (often < 30 s); without a replica a new writer in < 10 min | |
| Promotion tiers | 0 = promoted first … 15 = last; tie → largest instance | Lowest tier wins |
| Writer endpoint | name.cluster-xxxx…: follows the current writer |
|
| Reader endpoint | name.cluster-ro-xxxx…: balances per connection; with no replicas it reaches the writer |
Connections, not queries |
| Custom endpoint | name.cluster-custom-xxxx…; ≤ 5 per cluster; type READER or ANY; static or excluded members |
|
| Instance endpoint | Diagnostics on one instance; doesn't follow failover | |
| Aurora Auto Scaling | rds:cluster:ReadReplicaCount; RDSReaderAverageCPUUtilization or RDSReaderAverageDatabaseConnections; 0–15 replicas |
|
| ⚠️ Global Database | ≤ 10 read-only secondary Regions, replication < 1 s, up to 16 readers per secondary | |
| Global Database moves | Switchover = planned, no data loss; failover = Regional outage; write forwarding optional | |
| Storage configurations | Aurora Standard (pay per I/O) vs Aurora I/O-Optimized (I/O ≥ 25 % of spend) |
Aurora Serverless and the Data API
| Topic | Current facts | Memory hook |
|---|---|---|
| Serverless v2 | Instance class db.serverless; ACUs of about 2 GiB each; scales in place in 0.5-ACU steps |
|
| ⚠️ Capacity range | 0–256 ACUs on current engine versions | |
| Auto-pause | MinCapacity 0; SecondsUntilAutoPause 300–86,400 s (default 300); resume ≈ 15 s |
Zero ACU = asleep |
| Data API on a paused instance | DatabaseResumingException while it wakes → retry after a few seconds |
|
| Auto-pause blockers | Open connections, RDS Proxy, replication, Global Database, provisioned instances in the cluster | |
| Reader tiers | Tiers 0–1 follow the writer's capacity; tiers 2–15 scale independently | |
| ⚠️ Serverless v1 | End of life 2025-03-31 | |
| Data API enablement | --enable-http-endpoint at creation or aws rds enable-http-endpoint --resource-arn |
|
| Data API permissions | rds-data:ExecuteStatement (etc.) on the cluster + secretsmanager:GetSecretValue on the secret |
|
| Data API limits | 45 s per call, transaction expires after 3 min idle, 1 MiB response, 4 MiB request, writer only | |
| ⚠️ Data API scope | Aurora MySQL and PostgreSQL, provisioned or Serverless v2 | |
| Serverless metrics | ServerlessDatabaseCapacity (ACUs) and ACUUtilization (% of max) |
RDS Proxy
| Topic | Current facts | Memory hook |
|---|---|---|
| Purpose | Pools and multiplexes DB connections; absorbs Lambda storms; failover up to 66 % faster | Bouncer at the door |
| Engines | RDS for MariaDB, MySQL, PostgreSQL, SQL Server; Aurora MySQL/PostgreSQL; not Oracle or Db2 | |
| Network | Same VPC as the database; never public; an extra endpoint serves another VPC | |
| Quotas | 20 proxies per Region; 200 secrets per proxy; 20 additional endpoints per proxy | |
| Pool defaults | MaxConnectionsPercent 100 · MaxIdleConnectionsPercent 50 · ConnectionBorrowTimeout 120 s · IdleClientTimeout 1,800 s |
|
| Client IAM | rds-db:connect on arn:aws:rds-db:<region>:<acct>:dbuser:prx-<id>/<user>; token signed for the proxy endpoint |
|
| ⚠️ End-to-end IAM | DefaultAuthScheme IAM_AUTH since 2025-09-12: no Secrets Manager secrets needed |
|
| Pinning triggers | SET of an untracked variable, temporary tables, prepared statements, statements > 16 KB |
|
| Tracked without pinning (MySQL/MariaDB) | time_zone, sql_mode, autocommit, character-set variables, USE |
|
| Pinning fixes | Watch DatabaseConnectionsCurrentlySessionPinned; use InitQuery or EXCLUDE_VARIABLE_SETS |
|
| Targets | RDS: writer only; read-only endpoints for Aurora and Multi-AZ DB clusters | |
| TLS | Proxy uses ACM certificates; no RDS CA bundle needed for the proxy |
Encryption and IAM database authentication
| Topic | Current facts | Memory hook |
|---|---|---|
| At rest | KMS (AES-256) covers storage, logs, automated backups, snapshots and replicas | |
| RDS default | Unencrypted unless chosen at creation (--storage-encrypted, --kms-key-id) |
|
| ⚠️ Aurora default | New clusters encrypted by default since 2026-02-18 (AWS owned key) | |
| Encrypt an existing RDS instance | Snapshot → copy-db-snapshot --kms-key-id → restore new instance; ⚠️ or blue/green with TargetKmsKeyId |
Copy to encrypt |
| Replica encryption | Same state as the source; cross-Region uses a destination-Region key | |
| Snapshot sharing and keys | aws/rds-encrypted snapshots can't be shared; re-encrypt with a customer managed key |
|
| ⚠️ Default CA | rds-ca-rsa2048-g1; trust only the root bundle (global-bundle.pem) |
|
| Force TLS | PostgreSQL rds.force_ssl = 1 (⚠️ default on 15+); MySQL require_secure_transport = ON (dynamic) |
|
| IAM DB auth engines | RDS MariaDB, MySQL, PostgreSQL; Aurora MySQL and PostgreSQL; TLS required | |
| IAM token | generate-db-auth-token / generate_db_auth_token; valid 15 min; authenticates the login only |
|
| IAM policy | rds-db:connect on arn:aws:rds-db:<region>:<acct>:dbuser:<DbiResourceId>/<db-user> |
rds-db, not rds |
| Database user | MySQL: IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' · PostgreSQL: GRANT rds_iam |
|
| IAM DB auth limits | 300–1,000 MiB extra memory; no aws:SourceIp/aws:SourceVpc conditions; ⚠️ no fixed connections-per-second rule |
|
| Disabled KMS key | inaccessible-encryption-credentials-recoverable for 7 days, then terminal |
Backups snapshots and restores
| Topic | Current facts | Memory hook |
|---|---|---|
| RDS retention | 0–35 days; console default 7, API/CLI default 1; 0 = no backups and no PITR | |
| Aurora retention | 1–35 days, default 1, can't be turned off; continuous and incremental | |
| PITR | Transaction logs to S3 every 5 min; restore creates a new instance | Restore = new endpoint |
| Retention 0 ↔ non-zero | The change causes an outage | |
| Manual snapshots | Kept until deleted (survive instance deletion); 100 per Region | |
| Sharing | Manual snapshots only, ≤ 20 accounts, modify-db-snapshot-attribute --attribute-name restore; public only if unencrypted |
|
| Copying | Automated snapshot copy = manual snapshot; cross-Region copy runs in the destination Region | |
| Backtrack | Aurora MySQL only; window ≤ 72 h; enabled at creation or restore; rewinds in place | Rewind, don't restore |
| Cloning | Copy-on-write; up to 15 COW clones; same Region; --restore-type copy-on-write |
|
| Aurora CLI restore | Creates the cluster only → add the writer with create-db-instance |
|
| Restored instance settings | Default parameter and option groups unless specified |
ElastiCache engines and MemoryDB
| Topic | Current facts | Memory hook |
|---|---|---|
| ⚠️ Engines | Valkey, Memcached, Redis OSS; Valkey since 2024-10-08 (serverless 33 % and node-based 20 % cheaper) | Valkey = cheaper Redis twin |
| Serverless | Create with a name; 3 AZs; TLS and encryption at rest always (TLS clients); Valkey/Redis OSS: cluster-aware clients, authentication only through RBAC (no AUTH token) | |
| ⚠️ Public endpoint | Serverless Valkey 9.0+ only, IAM auth and TLS 1.3 required (2026-09-29) | |
| Cluster mode disabled | One shard: primary + up to 5 replicas; primary and reader endpoints | |
| Cluster mode enabled | Up to 500 shards (default quota 90 nodes); configuration endpoint | |
| Memcached | 1–60 nodes, multi-threaded, no replication, no backups on node-based clusters | Memcached forgets |
| ⚠️ Persistence | No AOF; Multi-AZ replicas + .rdb snapshots, or Valkey 9.0+ durability |
|
| Durability | Node-based Valkey 9.0+, cluster mode enabled, Multi-AZ; sync = zero loss, async ≤ 10 s at risk; can't be disabled | |
| AUTH token | Node-based only, requires TLS, 16–128 characters, rotate with ROTATE then SET |
|
| IAM authentication | Valkey 7.2+/Redis OSS 7.0+; elasticache:Connect; token 15 min; connection dropped after 12 h |
|
RBAC default user |
VALKEY-engine user groups don't need one; Redis OSS-engine groups do → swap in a disabled default |
|
| Ports | 6379 for Valkey/Redis OSS · 11211 for Memcached | |
| ⚠️ MemoryDB | "Amazon MemoryDB": durable primary database (Valkey/Redis OSS), µs reads, single-digit-ms writes | Memory that remembers |
Caching strategies TTL and session stores
| Topic | Current facts | Memory hook |
|---|---|---|
| Lazy loading | Cache → miss → database → write cache; 3 trips per miss; can be stale; survives node loss | Fetch on demand |
| Write-through | Write database and cache together; fresh data; 2 writes; churn; new nodes start empty | Write once, cache twice |
| ⚠️ TTL | Put one on every write, write-through included; add jitter; Valkey/Redis OSS seconds or ms, Memcached seconds | |
| Default eviction policy | volatile-lru: evicts only keys with a TTL |
No TTL, no eviction |
| Memory full, no TTLs | Writes fail: OOM command not allowed when used memory > 'maxmemory' |
|
| Many evictions | Scale up or out, or cache less | |
| Cache hit rate | CacheHitRate below about 0.8 signals evictions, expirations or missing keys |
|
| Session store | One key per session with SETEX; shared store keeps the web tier stateless |
|
| Leaderboards | Sorted sets: ZADD, ZINCRBY, ZREVRANGE … WITHSCORES |
|
| Stampede on hot key | TTL jitter, single rebuilder, refresh before expiry |
Numbers to know
| Item | Value | Note |
|---|---|---|
| ⚠️ Storage autoscaling free-space trigger | ≤ 10 % free for ≥ 5 min | Plus optimization finished and < 4 modifications in 24 h |
| Storage autoscaling minimum step | 10 GiB (or 10 %, or 7-hour forecast if larger) | |
| Maximum storage threshold margin | ≥ 10 % above allocated | 26 % recommended |
| RDS maximum storage | 64 TiB per instance | 256 TiB for Oracle and SQL Server with extra volumes |
| Stopped RDS instance | 7 days | Then RDS starts it |
| Read replicas per source | 15 | Db2: 3 |
| Cross-Region replicas guaranteed | 5 per source | VPC ACL limit |
| Multi-AZ DB instance failover | 60–120 s | |
| Multi-AZ DB cluster failover | < 35 s | Two readable standbys |
| JVM DNS TTL | ≤ 60 s | networkaddress.cache.ttl |
| Blue/green switchover | Typically < 1 min | Timeout 30–3,600 s, default 300 |
| Aurora copies of data | 6 across 3 AZs | Write quorum 4, read quorum 3 |
| Aurora Replicas per cluster | 15 | |
| ⚠️ Aurora replica lag | ≪ 100 ms | |
| ⚠️ Aurora failover with a replica | < 60 s, often < 30 s | Without a replica < 10 min |
| ⚠️ Aurora maximum volume | 256 TiB | 128 TiB on older engine versions |
| Aurora custom endpoints | 5 per cluster | Adjustable quota |
| ⚠️ Aurora Global Database secondaries | 10 Regions | Replication < 1 s, 16 readers each |
| ⚠️ Aurora Serverless v2 capacity | 0–256 ACUs | 1 ACU ≈ 2 GiB memory |
| Auto-pause delay | 300–86,400 s | Default 300 s; resume ≈ 15 s |
| Data API call timeout | 45 s | continueAfterTimeout keeps DDL running |
| Data API transaction idle expiry | 3 min | Rolled back automatically |
| Data API response size | 1 MiB | Request 4 MiB |
| RDS Proxy failover improvement | Up to 66 % faster | AWS figure for Aurora Multi-AZ |
| RDS Proxy idle client timeout | 1,800 s default | |
| RDS Proxy borrow timeout | 120 s default | Range 0–300 s |
| RDS Proxy quotas | 20 proxies, 200 secrets, 20 extra endpoints | |
| RDS Proxy pinning statement size | > 16 KB | |
| IAM DB auth token lifetime | 15 min | Only for new logins |
| IAM DB auth extra memory | 300–1,000 MiB | |
| RDS backup retention | 0–35 days | Console 7, API 1 |
| Aurora backup retention | 1–35 days | Default 1 |
| Transaction log upload for PITR | Every 5 min | |
| Manual snapshots per Region | 100 | Adjustable |
| Snapshot sharing | 20 accounts | Manual snapshots only |
| Backtrack window | ≤ 72 h | Aurora MySQL only |
| Aurora copy-on-write clones | 15 per source | Then full copies |
| ElastiCache replicas per shard | 5 | Up to 500 shards |
| Memcached nodes per cluster | 60 | |
| ElastiCache IAM token / connection | 15 min / 12 h |
Decision rules
- If you see storage that must grow without downtime, think
--max-allocated-storage(storage autoscaling). - If you see
Too many connectionsfrom Lambda bursts that must still be served, think RDS Proxy. - If you see reports slowing the primary and tolerating seconds of lag, think read replica.
- If you see read-after-write anomalies through a replica, think read from the primary.
- If you see automatic AZ failover with no read requirement, think Multi-AZ DB instance.
- If you see sub-minute failover plus readable standbys on RDS, think Multi-AZ DB cluster.
- If you see the app stuck on the old host after failover, think DNS caching (JVM TTL ≤ 60 s) and retries.
- If you see a low-downtime major upgrade, think blue/green deployment.
- If you see Region-level disaster recovery, think cross-Region replica or Aurora Global Database.
- If you see a reporting subset of Aurora replicas, think custom endpoint.
- If you see the wrong Aurora replica promoted, think promotion tiers.
- If you see fluctuating Aurora read load, think Aurora Auto Scaling of replicas.
- If you see an idle-at-night Aurora database, think Serverless v2 with 0 ACU minimum.
- If you see an Aurora serverless cluster that never pauses, think RDS Proxy or open connections.
- If you see Lambda outside a VPC running short SQL on Aurora, think RDS Data API.
- If you see pinned proxy connections, think
InitQueryor session pinning filters. - If you see "no secrets between proxy and database", think end-to-end IAM (
IAM_AUTH). - If you see "encrypt an existing database", think encrypted snapshot copy + restore, or blue/green with a target key.
- If you see "no passwords in code" for MySQL/PostgreSQL, think IAM database authentication.
- If you see
AccessDeniedon an IAM DB login, thinkrds-db:connectand theDbiResourceIdin the ARN. - If you see "reject non-TLS connections", think
rds.force_sslorrequire_secure_transport. - If you see an accidental delete on Aurora MySQL with Backtrack, think
backtrack-db-cluster. - If you see "share an encrypted snapshot", think customer managed key +
modify-db-snapshot-attribute. - If you see a fast, cheap test copy of Aurora, think copy-on-write clone.
- If you see sorted rankings or failover in a cache, think Valkey/Redis OSS, not Memcached.
- If you see unpredictable cache traffic with no capacity planning, think ElastiCache Serverless.
- If you see an in-memory system of record, think MemoryDB (or Valkey 9.0+ durability).
- If you see stale cache data after updates, think write-through or invalidation plus TTL.
- If you see
OOM command not allowedwith no TTLs, thinkvolatile-lru: add TTLs or scale. - If you see sessions lost when instances are replaced, think a shared session store.
Memory hooks
- Replica = read scale and maybe-stale; Multi-AZ = spare tyre that never serves reads (unless it's a Multi-AZ DB cluster).
- Same name, new IP: after any failover, reconnect and refresh DNS.
- Storage only grows: autoscaling up, never down.
- 10-5-4: 10 % free, 5 minutes, fewer than 4 storage changes a day.
- 6-4-3: six copies, four to write, three to read.
- Lowest tier wins: tier 0 is promoted first, tier 15 last.
- The reader endpoint deals connections, not queries.
- Custom endpoint = your own guest list of instances.
- Zero ACU = asleep; any connection wakes it in about 15 seconds.
- A proxy holds the door open, so serverless never sleeps behind it.
- Data API: 45 seconds, 1 MiB, 3 idle minutes.
rds-db:connect, notrds:Connect; resource ID, not instance name.- Tokens are tickets for entry (15 minutes), not passwords for the stay.
- Copy to encrypt: snapshot, encrypted copy, restore.
- Restore = new endpoint; Backtrack = same cluster, earlier time.
- Share manual, not automated; customer managed key, not
aws/rds. - Valkey = the cheaper Redis twin; Memcached forgets everything on a node loss.
- MemoryDB remembers; ElastiCache accelerates.
- Lazy loading fetches on demand; write-through writes twice.
- No TTL, no eviction under
volatile-lru. - Proxy ports: 3306 for the MySQL family, 5432 for PostgreSQL.