Architecture note2 lab guides2 lab guides

RDS · Relational Database Service

Parameter groups, failover, and the connection storms that outlive the outage.

Outcome

Postgres Provisioning & Connectivity
- Create a DB subnet group across 2 AZs and explain why 2 AZs are required
- Configure a security group for RDS and explain why a timeout (not refusal) signals an SG issue
- Create a custom parameter group and distinguish static vs dynamic parameters
- Provision an encrypted RDS instance and explain why encryption cannot be added post-creation
- Connect via SSM port forwarding without opening a public endpoint
Postgres Security: Encryption, IAM Auth, Secrets Manager
- Explain envelope encryption and the migration path for encrypting an unencrypted instance
- Enable IAM database authentication and generate a 15-minute auth token
- Explain why IAM tokens must be refreshed and not cached at application startup
- Store credentials in Secrets Manager and implement the correct rotation-aware fetch pattern
Postgres Backups, Restore & PITR
- Distinguish automated backups from manual snapshots and explain what each enables
- Perform a PITR to a specific timestamp and identify the new instance endpoint
- Explain why restore always creates a new instance and what that means for your runbook
- Copy a snapshot cross-region with a destination-region KMS key
Postgres Multi-AZ & Failover
- Enable Multi-AZ and explain what the standby is and is not
- Trigger a manual failover and observe the AZ flip via the same endpoint DNS name
- Measure failover duration from the ping script
- Explain why connection pools must handle reconnects and what happens without them
Postgres Read Replicas & Scaling
- Compare Multi-AZ standby vs read replica on the four dimensions: replication, readability, purpose, lag
- Create a read replica and confirm it is read-only at the engine level
- Implement the dual-pool pattern: writes to primary, reads to replica
- Promote a replica to standalone and explain when to use promotion
- Explain why writes to the replica endpoint cause ReadOnlySQLTransaction errors
Postgres Performance Insights & Monitoring
- Name the six key RDS CloudWatch metrics and their operational meaning
- Create alarms for CPU, connections, storage, and memory with correct thresholds
- Enable Enhanced Monitoring and read OS-level metrics from RDSOSMetrics log group
- Interpret DBLoad and identify the dominant wait event under load
- Use pg_stat_statements to find the top SQL by total execution time
- Explain why max_connections exhaustion happens and why PgBouncer is the fix