Understanding Amazon RDS Architecture and Core Components
Amazon RDS is a managed relational database service that handles infrastructure, backups, patching, and scaling automatically. The service supports MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server database engines.
RDS Infrastructure and Storage
Each RDS instance runs on a DB instance class, which determines available compute and memory resources. RDS operates within your VPC and uses security groups to control network access. The service stores data on Amazon EBS volumes, providing persistent storage with automatic backups.
Backup and Recovery Architecture
RDS provides automated backups retained for up to 35 days, enabling point-in-time recovery. You can create manual snapshots for long-term retention without expiration limits. Understanding this architecture is crucial because the exam tests your ability to design resilient solutions.
High Availability with Multi-AZ
Multi-AZ deployments synchronously replicate data to a standby instance in a different availability zone. The primary instance writes to both volumes simultaneously, ensuring zero data loss during failure. Failover completes automatically within 1-2 minutes, minimizing downtime.
The exam frequently tests scenarios where you choose between Single-AZ and Multi-AZ deployments based on RTO (recovery time objective) and RPO (recovery point objective) requirements.
Multi-AZ Deployments and Read Replicas: High Availability Strategies
Multi-AZ and read replicas serve different purposes but work together for optimal availability and performance scaling.
Multi-AZ for High Availability
Multi-AZ creates a synchronous standby replica in a different availability zone. The primary writes to both the primary volume and standby volume simultaneously. If the primary fails, the standby automatically becomes the new primary within 1-2 minutes, with a new standby automatically provisioned.
Multi-AZ increases costs because you run two instances, but it's essential for production workloads. It provides high availability but does not improve read performance during normal operations.
Read Replicas for Scaling Reads
Read replicas are asynchronous copies of your database that handle read traffic separately from writes. You can create up to 15 read replicas per DB instance in the same region or across regions.
Read replicas are ideal for read-heavy workloads because you direct read queries to replicas while maintaining writes on the primary. Cross-region read replicas provide geographic redundancy and faster data access for globally distributed applications.
Combining Both Strategies
Enable Multi-AZ for your primary to ensure high availability, then create read replicas to scale read capacity horizontally. This combination provides both disaster recovery and read performance optimization. The exam tests your ability to choose or combine both strategies based on specific requirements.
Backup Strategies, Recovery, and Data Protection in RDS
Backup and recovery capabilities are core exam topics because they directly impact business continuity and disaster recovery planning.
Automated Backups and Point-in-Time Recovery
RDS creates daily automated snapshots retained for up to 35 days. Point-in-time recovery (PITR) lets you restore your database to any second within the retention window, critical for recovering from accidental deletions or data corruption.
Snapshots are stored in Amazon S3 and can be shared across AWS accounts or regions. You can manually create snapshots at any time, and these are not subject to automated retention policies.
Manual Snapshots and Final Backups
When you delete an RDS instance, create a final snapshot before deletion to prevent accidental data loss. Restore operations create a new RDS instance, never overwriting the original, which prevents cascading failures.
Recovery Scenarios and Encryption
The exam tests recovery scenarios: if corruption occurs, use PITR to restore to a point before corruption. If availability zones fail, Multi-AZ provides automatic failover. For cross-region disaster recovery, promote cross-region read replicas to standalone instances.
Backup encryption uses AWS KMS, ensuring encrypted data at rest. Balance backup retention periods against storage costs. Longer retention periods provide greater recovery flexibility but increase costs.
RDS Performance Optimization and Instance Types
Choosing the correct DB instance type is fundamental to RDS design. Match instance types to specific workload requirements for optimal performance and cost.
Instance Type Categories
Instance types fall into three categories:
- Burstable (T-series) like db.t3.micro for variable workloads with moderate baseline performance, using CPU credits for bursting
- General purpose (M-series) like db.m5.large for balanced production workloads requiring moderate compute, memory, and network resources
- Memory optimized (R-series and X-series) like db.r5.xlarge for memory-intensive workloads like caching or in-memory analytics
Storage Types and Performance Monitoring
Performance depends on storage type. General Purpose SSD (gp2) provides good price-performance. Provisioned IOPS SSD (io1) offers predictable high performance for mission-critical databases. Magnetic storage is deprecated for new instances.
Monitor performance using CloudWatch metrics: CPU utilization, database connections, IOPS, and network throughput. Enhanced monitoring provides detailed OS-level metrics including process-level data.
Vertical and Horizontal Scaling
The exam tests knowledge of when to scale vertically (larger instance type) versus horizontally (read replicas). Read replicas distribute read queries, but writes always go to the primary. Vertical scaling remains necessary for write-heavy workloads. Multi-AZ does not improve performance during normal operation; it exists purely for high availability.
RDS Security, Networking, and Compliance Considerations
Security is a major exam focus for Solutions Architect. Implement layered security across networking, access control, encryption, and monitoring.
VPC Integration and Network Security
RDS integrates with VPCs through DB subnet groups spanning multiple availability zones, enabling Multi-AZ deployments. Security groups control inbound traffic at the instance level, typically restricting database ports (3306 for MySQL, 5432 for PostgreSQL) to application subnets.
This architecture provides network isolation and prevents unauthorized database access from external networks.
Encryption at Rest and in Transit
Encryption in transit uses SSL/TLS certificates, enforced by setting require_secure_transport parameters. Encryption at rest uses AWS KMS with customer-managed keys (CMK) for maximum control, or AWS-managed keys for simplicity.
Encryption can be enabled only at creation time. If encryption is required for an existing unencrypted instance, create a snapshot, restore to a new encrypted instance, and migrate applications.
Access Control and Monitoring
IAM database authentication allows credentials to be managed through AWS Identity and Access Management instead of storing passwords, eliminating hardcoded credentials. This is valuable for applications on EC2 or Lambda.
RDS integrates with AWS Secrets Manager for automatic password rotation. Compliance features include automatic encryption, detailed audit logging, and AWS CloudTrail integration for tracking API calls.
The exam tests layered security design: network isolation via VPCs, access control via security groups and IAM, encryption via KMS, and monitoring via CloudWatch and Enhanced Monitoring.