Home / AWS

AWSHow-toIntermediate

Production setup for a single RDS instance: parameters, backups, security and monitoring

Configure a Single-AZ RDS instance properly with storage autoscaling, parameter groups, backups and PITR, encryption, IAM auth, Performance Insights and maintenance windows, and know when to move to Multi-AZ.

Deepak Bhardwaj2 min read

Applies toAmazon RDS for PostgreSQL, MySQL, MariaDB, SQL Server and Oracle

When Single-AZ is acceptable

Dev/test, non-critical internal apps, or workloads where an hour of downtime during an AZ problem is acceptable. Everything below also applies to Multi-AZ.

1. Create it with the right defaults

aws rds create-db-instance --db-instance-identifier crm-prod \
  --engine postgres --engine-version 16.4 --db-instance-class db.r7g.large \
  --allocated-storage 200 --max-allocated-storage 1000 --storage-type gp3 \
  --master-username dbadmin --manage-master-user-password \
  --db-subnet-group-name db-private --vpc-security-group-ids sg-db \
  --no-publicly-accessible --storage-encrypted --kms-key-id alias/rds-prod \
  --backup-retention-period 14 --preferred-backup-window 19:00-20:00 \
  --preferred-maintenance-window sun:20:30-sun:21:30 \
  --enable-performance-insights --monitoring-interval 60 --monitoring-role-arn arn:aws:iam::111122223333:role/rds-monitoring \
  --enable-iam-database-authentication --deletion-protection \
  --db-parameter-group-name pg16-prod --copy-tags-to-snapshot
  • --manage-master-user-password stores the master password in Secrets Manager with rotation.
  • --max-allocated-storage enables storage autoscaling (avoids the "storage full" incident).
  • Times are UTC.

2. Parameter group (custom, never the default)

PostgreSQL examples: log_min_duration_statement = 1000, shared_preload_libraries = pg_stat_statements, idle_in_transaction_session_timeout = 300000. Static parameters need a reboot; plan it.

3. Backups and PITR

  • Automated backups (retention 7–35 days) + transaction logs → point-in-time restore to any second within retention (restores to a new instance).
  • Manual snapshots before upgrades and big changes.
  • AWS Backup for central policy and cross-region copies, or automated backup replication to another region.
aws rds restore-db-instance-to-point-in-time --source-db-instance-identifier crm-prod \
  --target-db-instance-identifier crm-prod-pitr --restore-time 2026-10-22T08:55:00Z \
  --db-subnet-group-name db-private --vpc-security-group-ids sg-db

4. Security

  • Private subnets, security group allowing only the app security group on the DB port.
  • TLS required (rds.force_ssl = 1 for PostgreSQL; require_secure_transport for MySQL).
  • IAM database authentication or Secrets Manager rotation for app users.

5. Monitoring

CloudWatch alarms: CPUUtilization, FreeStorageSpace, FreeableMemory, DatabaseConnections, ReadLatency/WriteLatency, and RDS event subscriptions (failover, low storage, maintenance) to SNS.

6. Maintenance

  • Minor version auto-upgrade on or off by policy; test majors in a copy first (blue/green deployments make major upgrades much safer).

Moving to Multi-AZ later

aws rds modify-db-instance --db-instance-identifier crm-prod --multi-az --apply-immediately

Online, but it can add I/O latency while the standby is created. Do it in a quiet period.

Related fixes