RDS security (encryption, security groups) in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is encryption at rest in Amazon RDS?

Encryption at rest means that the data stored on disk, including backups and snapshots, is encrypted to protect it from unauthorized access.

beginner

What role do security groups play in RDS security?

Security groups act like virtual firewalls that control which network traffic can reach your RDS database instances.

intermediate

How do you enable encryption for an RDS instance?

You enable encryption when creating the RDS instance by selecting the encryption option. It cannot be enabled later on an existing instance.

beginner

Can security groups restrict access by IP address?

Yes, security groups can allow or block access based on IP addresses or ranges, controlling who can connect to the RDS instance.

intermediate

Why is it important to use both encryption and security groups together for RDS?

Encryption protects data stored on disk, while security groups protect the database from unauthorized network access. Using both provides strong overall security.

What does encryption at rest protect in an RDS instance?

A Data stored on disk including backups

B Data only during transfer

C User passwords only

D Network traffic

Encryption at rest protects data stored on disk, including backups and snapshots.

When can you enable encryption on an RDS instance?

A At any time after creation

B Only after backups are taken

C Only during instance creation

D Only for read replicas

Encryption must be enabled when creating the RDS instance; it cannot be added later.

What is the main purpose of a security group in RDS?

A Backup the database

B Encrypt data on disk

C Manage database users

D Control network access to the database

Security groups control which network traffic can reach the RDS instance.

Can security groups restrict access based on IP addresses?

A Yes, they can allow or block specific IPs

B No, they only control ports

C No, they only control protocols

D Yes, but only for IPv6

Security groups can restrict access by IP addresses or ranges.

Why combine encryption and security groups for RDS security?

A They are unrelated features

B Encryption protects data; security groups control access

C Security groups backup data; encryption controls access

D Both encrypt data twice

Encryption protects stored data, while security groups protect network access.

Explain how encryption and security groups work together to secure an RDS instance.

Think about protecting data and controlling who can reach it.

Describe the steps to secure an RDS instance using encryption and security groups.

Consider what you do when setting up the database and its network rules.