RDS security (encryption, security groups) in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is encryption at rest in Amazon RDS?

Encryption at rest means that the data stored on disk, including backups and snapshots, is encrypted to protect it from unauthorized access.

beginner

What role do security groups play in RDS security?

Security groups act like virtual firewalls that control which network traffic can reach your RDS database instances.

intermediate

How do you enable encryption for an RDS instance?

You enable encryption when creating the RDS instance by selecting the encryption option. It cannot be enabled later on an existing instance.

beginner

Can security groups restrict access by IP address?

Yes, security groups can allow or block access based on IP addresses or ranges, controlling who can connect to the RDS instance.

intermediate

Why is it important to use both encryption and security groups together for RDS?

Encryption protects data stored on disk, while security groups protect the database from unauthorized network access. Using both provides strong overall security.

What does encryption at rest protect in an RDS instance?

A Data stored on disk including backups

B Data only during transfer

C User passwords only

D Network traffic

Encryption at rest protects data stored on disk, including backups and snapshots.

When can you enable encryption on an RDS instance?

A At any time after creation

B Only after backups are taken

C Only during instance creation

D Only for read replicas

Encryption must be enabled when creating the RDS instance; it cannot be added later.

What is the main purpose of a security group in RDS?

A Backup the database

B Encrypt data on disk

C Manage database users

D Control network access to the database

Security groups control which network traffic can reach the RDS instance.

Can security groups restrict access based on IP addresses?

A Yes, they can allow or block specific IPs

B No, they only control ports

C No, they only control protocols

D Yes, but only for IPv6

Security groups can restrict access by IP addresses or ranges.

Why combine encryption and security groups for RDS security?

A They are unrelated features

B Encryption protects data; security groups control access

C Security groups backup data; encryption controls access

D Both encrypt data twice

Encryption protects stored data, while security groups protect network access.

Explain how encryption and security groups work together to secure an RDS instance.

Think about protecting data and controlling who can reach it.

Describe the steps to secure an RDS instance using encryption and security groups.

Consider what you do when setting up the database and its network rules.

Practice

1. What does enabling storage_encrypted on an AWS RDS instance do?

easy

A. It encrypts the data stored on the disk to protect it at rest.

B. It encrypts data only during transfer between client and database.

C. It automatically backs up the database to another region.

D. It restricts access to the database based on IP addresses.

Solution

1. Step 1: Understand storage encryption purpose

   Storage encryption protects data saved on disk, making it unreadable without keys.

2. Step 2: Differentiate encryption types

   Encryption at rest means data on disk is encrypted; encryption in transit protects data moving over network.

3. Final Answer:

   It encrypts the data stored on the disk to protect it at rest. -> Option A

4. Quick Check:

   Storage encryption = data safe at rest [OK]

Hint: Storage encryption means data on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking storage_encrypted controls network access
• Assuming it automatically backs up data

2. Which of the following is the correct way to allow inbound traffic on port 3306 (MySQL) in an RDS security group?

easy

A. Allow inbound ICMP traffic on port 3306 from 0.0.0.0/0.

B. Allow outbound UDP traffic on port 3306 to any IP.

C. Allow inbound TCP traffic on port 3306 from the required IP range.

D. Allow inbound TCP traffic on port 22 from the required IP range.

Solution

1. Step 1: Identify correct protocol and port for MySQL

   MySQL uses TCP protocol on port 3306 for inbound connections.

2. Step 2: Confirm security group rule for inbound access

   Security groups must allow inbound TCP traffic on port 3306 from trusted IPs to permit database access.

3. Final Answer:

   Allow inbound TCP traffic on port 3306 from the required IP range. -> Option C

4. Quick Check:

   Inbound TCP 3306 = MySQL access allowed [OK]

Hint: Inbound TCP on port 3306 opens MySQL access [OK]

Common Mistakes:

• Using wrong protocol like UDP or ICMP
• Allowing outbound instead of inbound traffic
• Opening port 22 (SSH) instead of 3306

3. Given this security group rule for an RDS instance:
Inbound: TCP, Port 5432, Source: 192.168.1.0/24
Which client IP can connect successfully?

medium

A. 192.168.1.50

B. 192.168.2.10

C. 10.0.0.5

D. 172.16.0.1

Solution

1. Step 1: Understand CIDR range 192.168.1.0/24

   This range includes all IPs from 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP falls inside this range

   192.168.1.50 is inside the range; others are outside.

3. Final Answer:

   192.168.1.50 -> Option A

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.50 [OK]

Hint: Check if IP fits CIDR range to allow connection [OK]

Common Mistakes:

• Not understanding CIDR notation
• Assuming any 192.168.x.x IP is allowed
• Confusing inbound and outbound rules

4. You created an RDS instance with storage_encrypted: true but the console shows encryption as disabled. What is the likely cause?

medium

A. Encryption can only be enabled after instance creation.

B. The security group does not allow inbound traffic on the database port.

C. The IAM role lacks permissions to enable encryption.

D. The RDS instance was created from a snapshot that was not encrypted.

Solution

1. Step 1: Understand encryption behavior on RDS creation

   Encryption must be enabled when creating the instance or from an encrypted snapshot.

2. Step 2: Identify snapshot encryption impact

   If created from an unencrypted snapshot, encryption cannot be enabled later.

3. Final Answer:

   The RDS instance was created from a snapshot that was not encrypted. -> Option D

4. Quick Check:

   Unencrypted snapshot blocks encryption [OK]

Hint: Encryption depends on snapshot encryption at creation [OK]

Common Mistakes:

• Thinking encryption can be toggled anytime
• Confusing security group issues with encryption status
• Assuming IAM permissions control encryption flag

5. You want to secure an RDS instance so only your application servers in a private subnet can connect, and data is encrypted at rest. Which combination is best?

hard

A. Disable encryption and allow inbound from 0.0.0.0/0 for easy access.

B. Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only.

C. Enable encryption but allow inbound from all IPs to avoid connection issues.

D. Use a public subnet for RDS and restrict access by username only.

Solution

1. Step 1: Enable storage encryption for data safety

   Setting storage_encrypted ensures data is encrypted at rest.

2. Step 2: Restrict access via security group to private subnet

   Allowing inbound only from private subnet CIDR limits access to trusted app servers.

3. Final Answer:

   Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only. -> Option B

4. Quick Check:

   Encryption + restricted SG = secure RDS [OK]

Hint: Encrypt data and restrict SG to private subnet [OK]

Common Mistakes:

• Allowing open access (0.0.0.0/0) to RDS
• Disabling encryption for convenience
• Using public subnet exposing RDS to internet