15. Amazon RDS for MySQL: Create, Connect, Back Up and Keep It Private
15.6 Hardening RDS: Never Public, Encrypted, Monitored
| Control | Setting | Why |
|---|---|---|
| Public access | No, private subnets | Not reachable from the internet at all |
| Security group | 3306 from web-sg only |
Only the app tier can connect |
| Encryption at rest | ON at creation (KMS) | Cannot be switched on later without snapshot + restore |
| TLS in transit | REQUIRE SSL users; verify the CA bundle |
No plain-text passwords on the network |
| Users | admin only for admin work; reels_app with minimum grants |
Limits SQL injection damage |
| Passwords | Secrets Manager or strong unique password, rotated | No weak/default credentials |
| Deletion protection | ON | Stops accidental or malicious delete |
| Backups | Retention ≥ 7 days, manual snapshot before changes | Recovery |
| Monitoring | CloudWatch alarms (CPU, connections, free storage), error/slow logs exported | Detect attacks and problems |
| Updates | Auto minor version upgrade, maintenance window | Security patches |
Why this matters for security
Credentials in application code pushed to GitHub, a public endpoint and an over-privileged app user together turn a small bug into a full data breach. Each control in the table breaks one link of that chain – this is defence in depth (बहुस्तरीय संरक्षण), a phrase you will hear again in the ethical hacking part.
Ravindra Bagale's Tip
Encryption RDS banvtanach on karava lagto – nantar "Modify" madhe option nasto. Khup students he nantar shodhtat. Checklist create karnya aadhi vacha, nantar nahi. Aani DB password config file madhe asel tar ti file web root chya baher theva – project madhe aapan tech karnar aahot.
Practice task
Audit your reels-db against the table: note each control as done or not done, fix the gaps, and create a CloudWatch alarm for low free storage.
Thodkyaat sangaycha tar
- RDS = managed MySQL: AWS runs the server, you own users, data, network rules and your code.
- Same VPC as EC2; DB subnet group across two AZs;
db-sgallows 3306 only fromweb-sg. - Create with public access No, encryption ON, deletion protection ON, backups ≥ 7 days; use the endpoint, not an IP.
- Connect from EC2 with
mysql -h <endpoint>(client:mariadb105/mysql-client), use TLS, and create a least-privilegereels_appuser. - Laptop access = SSH tunnel through EC2, never a public database.
- Point-in-time restore and snapshots always create a new instance.
Samjla ka? S3 madhe videos, RDS madhe data – aata aapan he donhi vaparun ek khara project banvuya. Chala, Part 8!