15. Amazon RDS for MySQL: Create, Connect, Back Up and Keep It Private
15.6 Hardening RDS: Never Public, Encrypted, Monitored
| Control | Setting | Why |
|---|---|---|
| Public access | No, private subnets | Not reachable from the internet at all |
| Security group | 3306 from web-sg only |
Only the app tier can connect |
| Encryption at rest | ON at creation (KMS) | Cannot be switched on later without snapshot + restore |
| TLS in transit | REQUIRE SSL users; verify the CA bundle |
No plain-text passwords on the network |
| Users | admin only for admin work; reels_app with minimum grants |
Limits SQL injection damage |
| Passwords | Secrets Manager or strong unique password, rotated | No weak/default credentials |
| Deletion protection | ON | Stops accidental or malicious delete |
| Backups | Retention ≥ 7 days, manual snapshot before changes | Recovery |
| Monitoring | CloudWatch alarms (CPU, connections, free storage), error/slow logs exported | Detect attacks and problems |
| Updates | Auto minor version upgrade, maintenance window | Security patches |
Why this matters for security
Credentials in application code pushed to GitHub, a public endpoint and an over-privileged app user together turn a small bug into a full data breach. Each control in the table breaks one link of that chain – this is defence in depth (बहुस्तरीय संरक्षण), a phrase you will hear again in the ethical hacking part.
Ravindra Bagale's Tip
Encryption has to be turned on when you create the RDS instance – there's no option for it later under "Modify". Many students go looking for it later. Read the checklist before creating, not after. And if the DB password is in a config file, keep that file outside the web root – that's exactly what we'll do in the project.
Ravindra Bagale's Tip – मराठी
Encryption RDS बनवतानाच on करावं लागतं – नंतर "Modify" मध्ये option नसतो. बरेच students हे नंतर शोधतात. Checklist create करण्याआधी वाचा, नंतर नाही. आणि DB password config file मध्ये असेल तर ती file web root च्या बाहेर ठेवा – project मध्ये आपण तेच करणार आहोत.
Ravindra Bagale's Tip – हिंदी
Encryption RDS बनाते समय ही on करना पड़ता है – बाद में "Modify" में option नहीं होता. बहुत से students इसे बाद में ढूँढते हैं. Checklist create करने से पहले पढ़ो, बाद में नहीं. और DB password config file में हो तो वह file web root के बाहर रखो – project में हम यही करने वाले हैं.
Practice task
Audit your reels-db against the table: note each control as done or not done, fix the gaps, and create a CloudWatch alarm for low free storage.
Thodkyaat sangaycha tar
- RDS = managed MySQL: AWS runs the server, you own users, data, network rules and your code.
- Same VPC as EC2; DB subnet group across two AZs;
db-sgallows 3306 only fromweb-sg. - Create with public access No, encryption ON, deletion protection ON, backups ≥ 7 days; use the endpoint, not an IP.
- Connect from EC2 with
mysql -h <endpoint>(client:mariadb105/mysql-client), use TLS, and create a least-privilegereels_appuser. - Laptop access = SSH tunnel through EC2, never a public database.
- Point-in-time restore and snapshots always create a new instance.
Samjla ka? S3 madhe videos, RDS madhe data – aata aapan he donhi vaparun ek khara project banvuya. Chala, Part 8!