Amazon RDS is the database "that Amazon maintains": you choose the engine and the size and they take care of installing, updating, backing up and monitoring. It is the natural step when a website grows or when you want the database not to live on the same machine as the website. The form has a lot of options and one trap: the public access box. If you tick it, the database is exposed to the internet; if you do not tick it and do not get the rest right, the website will not connect and you will not know why. This guide follows the correct path.
Before you start: what each thing means
- RDS
- Relational Database Service, Amazon's managed database service. It supports MySQL, PostgreSQL, MariaDB and others.
- Database instance
- Each database you create in RDS, with its size and its address.
- Engine
- The database system: MySQL is the usual one for websites; PostgreSQL for many custom applications.
- Endpoint
- The address your website connects to, instead of "localhost".
- Public access
- Whether the database has an address on the internet. It should be off: only your AWS machines should reach it.
- Security group
- The AWS firewall. The database will have one that must allow inbound traffic from the group of your web machine.
- Multi-AZ
- Option to have a replica in another data centre that takes over if the main one fails. It costs twice as much; you do not need it to begin with.
- Master user
- The main user of the database. You set its password yourself or let AWS manage it.
Step by step
Prepare the database security group
Before the form, in EC2, Security Groups, Create: name
bd-interna, one inbound rule of type MYSQL/Aurora (port 3306) with the security group of your web machine as the source (pick the group from the dropdown instead of an IP). That way, only machines carrying that group will be able to connect. If you prefer, the RDS form has a shortcut that does this for you ("Connect to an EC2 compute resource"), but knowing how to do it by hand will serve you later.Open the RDS form
RDS console, same region as your machine, Create database. Choose Standard create (the easy one hides the public access box), engine MySQL, the recommended version. Under templates, Free tier if your account has it and this is for testing, or Dev/Test for a small website; Production turns on Multi-AZ and costs more.
Name, user and size
Identifier
bd-web. Master useradminor one of your own; password: let AWS Secrets Manager manage it if you do not mind a small cost, or set a long one of your own and keep it in a password manager. Instance class: the smallest of the t family (db.t4g.microordb.t3.micro) to begin with; it can be changed later. Storage gp3, 20 GB, with autoscaling enabled and a sensible cap (for example 100 GB) so it does not fill up.Connectivity: the part that matters
Under Connectivity: compute resource Don't connect (you do it with the security group), the default VPC, Public access: No. For the security group, Choose existing and select
bd-interna; removedefault. Leave port 3306. Further down, under Additional configuration, type an initial database name (tienda) so you do not have to create it by hand, leave automated backups enabled with 7 days and an early-morning window, and enable encryption. Create. It takes about 5 to 10 minutes.Test the connection from the web machine
When the status is "Available", open the database and copy the endpoint from the Connectivity tab. SSH into your web machine and try:
mysql -h tu-endpoint.eu-west-1.rds.amazonaws.com -u admin -p tiendaIf you get in, everything is fine. If it hangs without answering, it is the security group (step 1); if it says "Access denied", it is the user or the password.
Connect the website and take a backup
In your application's configuration change the server to that endpoint, with the user and the password. If you are bringing data from another database, dump it with
mysqldumpand import it withmysqlas in any migration. When it works, take a manual snapshot from RDS: your first safe point of return. Automated backups will carry on every day.
What can go wrong
The website will not connect and the database is "Available"
Security group in 95% of cases: the inbound rule for 3306 does not have your web machine's group as its source, or the web machine is not carrying that group. Check both sides.
I want to connect from my computer with a graphical program
Without public access, you cannot do it directly. The right way is an SSH tunnel through the web machine (graphical programs usually have it built in). Turning public access on "for a while" gets forgotten and stays on.
The bill is higher than I expected
Check whether Multi-AZ got enabled (Production template), whether storage autoscaled on its own or whether Secrets Manager and Performance Insights are active. And remember that RDS is billed by the hour even if nobody uses it: there is a guide on stopping it.
It asks me for a password I do not have
If you left the password in Secrets Manager, it is there (Secrets Manager console, the database's secret). If you set it yourself and lost it, in RDS you can Modify the instance and set a new one without a reboot.
In Simplio
In Simplio you create the RDS database from a short form, choosing which machine should be able to connect to it: Simplio creates the right security group, leaves public access closed and backups enabled, and shows you the endpoint ready to paste into the website. Databases appear next to their machines with their status, backups and a snapshot button, and each person only sees the ones you have assigned to them.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Create the database properly | Security group in EC2 plus an 8-block RDS form: 30 minutes and knowing what public access is | 4-field form with public access closed and the firewall open only to the machine you choose |
| Test the connection | SSH to the web machine and mysql command | "Test connection" button from the chosen machine |
| Backups and status | RDS tabs | On the same card as the machine, with an alert if a backup is missing |