RDS MySQL, private connections, backups and availability

Why and what

RDS manages underlying database infrastructure and many backup/patching operations. You still design schemas, tune queries, manage users and choose recovery settings. RDS MySQL is a relational engine, not an S3 filesystem. Use its DNS endpoint; failover or maintenance can change underlying addresses.

Build the database

1. Create a DB subnet group covering at least two AZs in your VPC using private subnets.
2. Create an RDS MySQL instance using a supported version. Review the instance class, storage and availability configuration price.
3. Set public access to No. Attach a DB security group allowing TCP 3306 only from the application's security group.
4. Configure encryption, backup retention, a maintenance window and deletion protection according to the lab's purpose.
5. Manage the master secret securely. Connect from the EC2 application host and create a separate least-privilege application user.
6. Download the current RDS CA bundle from the official trust store and verify the TLS connection.

mysql -h DB_ENDPOINT -u ADMIN -p \
  --ssl-mode=VERIFY_IDENTITY --ssl-ca=/path/global-bundle.pem

SHOW SESSION STATUS LIKE 'Ssl_cipher';
CREATE DATABASE reels CHARACTER SET utf8mb4;

MySQL user scope

An application username/password is separate from an IAM instance role. IAM database authentication is an optional token-based capability with prerequisites; attaching an S3 role does not grant SQL access. If using password authentication, rotate and restrict the secret. Do not run the web application as the RDS master account.

Availability versus scale

A traditional Multi-AZ DB instance standby improves failover availability but is not a read-scaling endpoint. Multi-AZ DB clusters have a different reader architecture. Read replicas serve reads and usually replicate asynchronously; lag matters. Backups enable recovery to another point/resource and do not replace failover design.

Restore lab

Take a snapshot, create test rows, then restore a snapshot or point-in-time copy into a new database resource. Connect to its new endpoint, verify rows and record recovery time. Do not assume a restore overwrites the original database in place.

Troubleshooting and cleanup

Timeout: inspect VPC routing and SGs. Access denied: inspect SQL account/host/password. Certificate error: inspect hostname, CA bundle and rotation. Too many connections: inspect application pooling and limits. When finished, decide deliberately whether to retain a final snapshot; deletion protection must be disabled only for the intended lab resource.

Official references

RDS MySQL connections RDS TLS RDS high availability

Interview and revision check

Why connect using the RDS endpoint instead of a remembered IP?

The managed endpoint abstracts underlying address changes during maintenance/failover and supports correct hostname-based TLS verification.