Secuirty in AWS RDS

1 min read

Related: RDS

Encryption and Encoding

Encryption in transit: accomplished with SSL/TLS connection between client and RDS instance, can be mandatory.

Encryption at rest: RDS supports EBS KMS encryption1, with either AWS managed keys or Customer managed keys. Data key (DEK) is used for encryption operations.
Encryption cannot be removed!

Elements which being encrypted:

  • Storage
  • Logs
  • Snaphots
  • replicas

MSSQL and Oracle support TDE2, in addition latter supports TDE with Cloud-HSM meaning no key exposure to AWS.

IAM (Authentication only)

For IAM access an RDS local DB would require a local user configured to use AWS Authentication Token. Next, IAM Instance Profile with necessary permissions and users is attached to a RDS instance, hence mapping user to a RDS local DB user.

generate-db-auth-token operation is used to generate 15 minute validity token which is used in place of password a DB user’s password.

Footnotes

  1. done by the RDS HOST itself ↩

  2. transparent data encryption – data is encrypted and decrypted by the DB engine itself. ↩

Graph View

Backlinks