‫Now, here is a quick lecture
‫around RDS and Aurora Security.
‫So you can encrypt the data at-rest
‫on your RDS and Aurora database.
‫That means that the data is encrypted on the volumes.
‫For this, you will be having the master
‫and any replica encrypted using KMS.
‫And this is defined at launch time
‫during the first launch of your database.
‫If somehow you haven't encrypted the master database,
‫the main database,
‫then the read replicas cannot be encrypted.
‫Also, if you wanted to encrypt
‫an already existing unencrypted database,
‫what you would have to do is to take a database snapshot
‫from that un-encrypted database,
‫and then you restore that database snapshot
‫as an encrypted database. Okay?
‫So you have to go through a snapshot and restore operation.
‫So this is for at-rest encryption.
‫Then you have in-flight encryption.
‫So between your clients and your database.
‫So each database on RDS and Aurora
‫is ready to have in-flight encryption by default.
‫And so therefore, your clients must
‫use the TLS root certificates from AWS.
‫They're provided on the AWS website.
‫In terms of database authentication.
‫Because this is RDS and Aurora,
‫you can use the classic combo of username and password.
‫But because it says AWS,
‫you can also use IAM roles to connect to your database.
‫That means that's, for example,
‫if you're EC2 instances had IAM roles,
‫they can authenticate to your database directly using that
‫and not a username and a password,
‫which can help you manage all the security
‫within AWS and IAM.
‫You can also control network access to your database
‫using security groups.
‫So you can allow or block specific ports,
‫specific IP, specific security groups.
‫And then finally RDS and Aurora do not have SSH access,
‫of course, because they're managed services,
‫except if you use the RDS custom service from AWS.
‫And if you wanted Audit Logs.
‫So to know what queries are being made
‫on RDS and Aurora over time
‫and what's happening on databases,
‫you can enable Audit Logs.
‫And then they will be lost after a bit of time.
‫Therefore, if you wanted to keep them
‫for a long period of time,
‫what you need to do is to send them into a dedicated service
‫called the CloudWatch Logs service on AWS.
‫So that's it for the short lecture
‫on the summary options for security, for RDS and Aurora.
‫I hope you liked it.
‫And I will see you in the next lecture.