SecureAnyCloud
Golden Images
  • About SecureAnyCloud
  • AWS CFT for WAMP with Aurora
    • Introduction
      • Overview
      • Resources
      • High Availability
      • Deployment time
    • Architecture
    • Getting Started
      • Pre-Requisites
    • Configuration
      • Service Limits
      • Network Configuration
      • Backup, maintenance & recovery
        • DR Strategy
    • After deployment
      • Support
      • SLA
      • Health Check
      • Auto-Scaling
    • Security Best Practices
      • Security for Amazon Aurora
        • Encryption
      • AWS EC2 Security
      • Secrets Management
        • Rotating Keys
      • Public Assets
    • Instance Sizing
    • Costing
  • CFT: Secured WAMP With Aurora - Windows 2016
  • MySql Change Password
  • PHP on cloud
  • [Stack_Name]
Powered by GitBook
On this page

Was this helpful?

  1. AWS CFT for WAMP with Aurora
  2. Security Best Practices

Security for Amazon Aurora

PreviousSecurity Best PracticesNextEncryption

Last updated 4 years ago

Was this helpful?

Security for Amazon Aurora is managed at three levels:

  • To control who can perform Amazon RDS management actions on Aurora DB clusters and DB instances, you use AWS Identity and Access Management (IAM). When you connect to AWS using IAM credentials, your AWS account must have IAM policies that grant the permissions required to perform Amazon RDS management operations. For more information, see .

    If you are using IAM to access the Amazon RDS console, you must first log on to the AWS Management Console with your IAM user credentials, and then go to the Amazon RDS console at .

  • Aurora DB clusters are created in a virtual private cloud (VPC) based on the Amazon VPC service. To control which devices and Amazon EC2 instances can open connections to the endpoint and port of the DB instance for Aurora DB clusters in a VPC, you use a VPC security group. You can make these endpoint and port connections using Transport Layer Security (TLS)/Secure Sockets Layer (SSL). In addition, firewall rules at your company can control whether devices running at your company can open connections to a DB instance. For more information on VPCs, see .

  • To authenticate logins and permissions for an Amazon Aurora DB cluster, you can take either of the following approaches, or a combination of them.

    • You can take the same approach as with a stand-alone DB instance of MySQL or PostgreSQL.

      Techniques for authenticating logins and permissions for stand-alone DB instances of MySQL or PostgreSQL, such as using SQL commands or modifying database schema tables, also work with Aurora. For more information, see

    • You can also use IAM database authentication for Aurora MySQL.

      With IAM database authentication, you authenticate to your Aurora MySQL DB cluster by using an IAM user or IAM role and an authentication token. An authentication token is a unique value that is generated using the Signature Version 4 signing process. By using IAM database authentication, you can use the same credentials to control access to your AWS resources and your databases. For more information, see .

For information about configuring security, see .

Identity and access management in Amazon Aurora
https://console.aws.amazon.com/rds
Amazon Virtual Private Cloud VPCs and Amazon Aurora
Security with Amazon Aurora MySQL
IAM database authentication
Security in Amazon Aurora