Amazon RDS

What it is

Amazon Relational Database Service (Amazon RDS) is a managed service for relational (SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry) databases. AWS provisions the hardware, installs and patches the database engine, takes backups, and handles FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry. You choose the engine, the DB instance class, and the storage, and you manage the schema, the queries, and who can connect.

RDS supports Db2, MariaDB, Microsoft SQL Server, MySQL, Oracle, and PostgreSQL. Amazon Aurora, the AWS-built MySQL- and PostgreSQL-compatible engine, is managed through RDS too, but works differently enough to have its own tutorial.

Choose RDS when an application needs a relational database with SQL, joins, and transactions, and you don't want to run the database on EC2 yourself. You can't log in to the host operating system of a standard RDS instance; when an application needs OS or database-level customization, RDS Custom (for Oracle and SQL Server) gives you that access, and running the database on EC2 gives you full control.

Concepts

DB instance: an isolated database environment, with a DB instance class (CPU and memory) and storage. You connect to its endpoint, a DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry name.
DB SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry group: the VPC subnets, in at least two AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry, where RDS can place instances. Keep databases in private subnets, reached through Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry.
Parameter groups hold engine settings; option groups add engine features such as Oracle Transparent Data Encryption.
Storage: General Purpose SSD (Solid state drive)Storage on flash memory with no moving parts, fast at small random reads and writes (high IOPS). Amazon EBS gp3, gp2, io2, and io1 volumes are SSD-backed.Glossary entry (gp2, gp3) or Provisioned IOPS (Input/output operations per second)How many read and write operations a storage volume can handle each second. It matters for databases that make many small random reads and writes; throughput, in MB per second, matters for large sequential ones.Glossary entry SSD (io1, io2). Db2, MariaDB, MySQL, and PostgreSQL go up to 64 TiB; Oracle and SQL Server reach 256 TiB with additional storage volumes. Storage autoscaling grows storage automatically when it runs low.
Vector search: RDS for PostgreSQL supports the pgvector extension, so you can store vector embeddings next to relational data and run similarity searches with SQL.

High availability and read scaling

Feature	What it does	Replication	Readable?	Failover
Multi-AZRunning standby or extra copies of a resource in other Availability Zones so that it survives the loss of one. An Amazon RDS Multi-AZ deployment keeps one or two standby copies and fails over to one automatically.Glossary entry DB instance	One standby in another Availability Zone	Synchronous	No, the standby serves no traffic	Automatic, typically 60–120 seconds; the endpoint's DNS points to the new primary
Multi-AZ DB cluster	A writer and two readable standbys in three Availability Zones (MySQL and PostgreSQL)	Semisynchronous: a commit needs at least one reader to acknowledge	Yes, through a reader endpoint	Automatic, typically under 35 seconds
Read replicaA read-only copy of a database that is updated asynchronously from the primary. It takes read traffic off the primary, can be in another Region, and can be promoted to a standalone database.Glossary entry	Up to 15 read-only copies per source, in the same or another AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry	Asynchronous, so reads can be slightly stale	Yes, each has its own endpoint	Not automatic: you promote a replica to a standalone instance

Remember the split: Multi-AZ is for availability and read replicas are for read scaling (and cross-Region DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry). A read replica can itself be Multi-AZ. RDS does not add or remove read replicas automatically; you create them yourself.

An application sends writes and reads to the primary DB instance in Availability Zone A. The primary replicates synchronously to a standby in Availability Zone B, which serves no traffic until a failover. The primary also replicates asynchronously to a read replica, which has its own endpoint and serves the application's reads.

Security, resilience, performance, and cost

Security

Network: place instances in private subnets and allow the database port only from the application's security group. Keep public access off unless there is a real need.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry with AWS KMS covers the storage, logs, automated backups, read replicas, and snapshots. You turn it on when you create the instance. To encrypt an existing unencrypted instance, take a snapshot, copy it with encryption on, and restore from the encrypted copy (or use a Blue/green deploymentReleasing a new version (green) alongside the running one (blue), then moving traffic to green once it is ready. Rolling back is quick: move the traffic back to blue.Glossary entry). You can't remove encryption once it's on. A read replica always has the same encryption state as its source, so you can't add an encrypted replica to an unencrypted instance: recreate the read replicas from the new encrypted instance.
Encryption in transitEncrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.Glossary entry: connect with TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry; you can require it with a parameter.
Authentication: IAM database authentication (MariaDB, MySQL, PostgreSQL) replaces passwords with tokens that last 15 minutes. RDS can also manage the master password in AWS Secrets Manager and rotate it.
Auditing: AWS CloudTrail records RDS API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls; database logs (such as audit logs) can be published to CloudWatch Logs.

Resilience

Automated backups run daily in the backup window and keep transaction logs, uploaded to S3 every five minutes. Retention is 0 to 35 days (0 turns automated backups off).
PITR (Point-in-time recovery)Restoring a database to its state at a chosen moment within a retention period, using continuous backups. Amazon RDS, Amazon Aurora, Amazon DynamoDB, and AWS Backup support it.Glossary entry restores to any second in the retention period, typically up to the last five minutes. Every restore creates a new DB instance with a new endpoint.
Manual snapshots are kept until you delete them, even after the instance is deleted. You can copy snapshots to other Regions and share manual snapshots with other accounts. Automated backups can't be shared directly; copy one to a manual snapshot first. An encrypted snapshot can be shared only if it uses a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry whose key policy lets the other account use it; snapshots encrypted with the default aws/rds key can't be shared. Cross-Region automated backup replication keeps PITR available in a second Region.
Blue/green deployments create a synchronized staging (green) copy for upgrades or schema changes, then switch over with minimal downtime.

Performance

Scale up by changing the instance class (this causes a short outage, or a failover with Multi-AZ). Scale reads out with read replicas.
Choose gp3 to set IOPS and throughput separately from size, or io2 for consistent high IOPS.
Amazon RDS Proxy pools and shares database connections. It suits AWS Lambda and other applications that open many short connections, keeps connections open during failover, and can enforce IAM authentication, with database credentials in Secrets Manager. A proxy lives in the same VPC as the database and is never publicly accessible.
Add a cache such as Amazon ElastiCache for repeated reads.

Cost

Pay for the instance hours, storage (and provisioned IOPS), backup storage beyond the size of your databases, and data transfer. A Multi-AZ deployment pays for the standby too.
Read replicas are billed as normal instances. Replication data transfer within a Region is free; cross-Region replication is charged.
Save on steady usage with Reserved DB Instances or Database Savings Plans.
You can stop an instance to save instance-hour charges, but RDS starts it again after seven days. For databases that sit idle, consider Aurora Serverless, which can scale to zero.

Monitoring

Amazon CloudWatch metrics (CPU, free storage, connections, replica lag) and alarms; Enhanced Monitoring adds operating-system metrics from an agent on the instance.
CloudWatch Database Insights, which now includes Performance Insights, shows database load by waits, SQL statements, hosts, and users.
RDS events (failovers, backups, maintenance) can notify you through Amazon EventBridge or Amazon SNS.

RDS or another option?

If the requirement is	Choose
A managed relational database with a standard engine	Amazon RDS
MySQL or PostgreSQL with faster failover, more replicas, and storage that grows on its own	Amazon Aurora
A relational database for spiky or idle workloads, with no instance sizing	Aurora Serverless
Access to the host OS of a managed Oracle or SQL Server database	RDS Custom
Full control of the database software and OS	Self-managed database on EC2
Key-value access at any scale, with millisecond LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry	Amazon DynamoDB
Analytics over large volumes of data	Amazon Redshift

Reverse mindmap: when the question points here

Is it Amazon RDS?

Yes, when the question says
- Managed MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, or Db2 leads to Amazon RDS
- Relational database without managing servers or patches leads to Amazon RDS
Make it available
- Survive an Availability Zone failure leads to Multi-AZ
- Standby that also serves reads leads to Multi-AZ DB cluster
- Failover with no application change leads to Same endpoint, DNS moves
Scale and speed it up
- Offload read-heavy queries or reports leads to Read replicas
- Disaster recovery in another Region leads to Cross-Region read replica
- Lambda opening too many connections leads to RDS Proxy
- Storage keeps running out leads to Storage autoscaling
Protect it
- Encrypt an existing unencrypted database leads to Snapshot, encrypted copy, restore
- Connect without a database password leads to IAM database authentication
- Rotate the master password leads to Secrets Manager
- Restore to a moment before a bad change leads to Point-in-time recovery
- Keep backups longer than 35 days leads to Manual snapshots or AWS Backup
- Give another account a restorable copy leads to Share a manual snapshot, customer managed key
No, when the question says
- Access to the host OS leads to RDS Custom or EC2
- Single-digit millisecond key-value at any scale leads to DynamoDB

Key takeaways

RDS runs six relational engines for you; Aurora is managed through RDS but is a separate engine.
Multi-AZ DB instance: synchronous standby, not readable, failover in 60–120 seconds. Multi-AZ DB cluster: two readable standbys, failover under 35 seconds.
Read replicas: up to 15, asynchronous, readable, cross-Region possible, promoted by hand.
Backups: 0–35 days of retention with point-in-time recovery; restores create a new instance. Manual snapshots last until deleted.
Encryption is chosen at creation; to encrypt later, snapshot, copy encrypted, and restore.
RDS Proxy pools connections for Lambda and speeds up failover.