Saturday, June 4, 2022

Aws RDS : Production - High availability - Security - Cost effective

 

AWS RDS 

Overview :

  • RDS stands for Relational Database Service

  • Managed DB DB service uses SQL as the query language

  • Allows you to create AWS cloud-based database

- Postgress

- MySQL

- Oracle

- MariaDB

- MSSQL

- Aurora (AWS proprietary database)


Advantages of using RDS against DB emission in EC2


  • RDS is a managed service:

- Automatic rendering, OS patching

- Backup continuous and restore a temporary stamp

- Monitor dashboards

- Read similes to learn advanced

- Multi AZ DR Set (Disaster Recovery)

- Fix windows to upgrade

- Measurement capacity (vertical and horizontal)

- Storage is supported by EBS

  • But you can't apply SSH to your conditions

  • Amazon RDS database instances use Amazon EBS volumes for storage.

  • Aurora instances use AWS proprietary storage volumes.

  • EC2 instances enable a variety of options for storage.

Best database storage type options

 Amazon RDS offers the following three types:


  • General Purpose SSD (also known as gp2 volumes)

  • IOPS SSD provided (also known as io1)

  • Magnetic


The I/O capacity of the instance is based on the instance storage type and size. The more storage you provision, the higher the IOPS capacity. If the DB instance has allocated a 100-GiB gp2 volume, the baseline IOP capacity is 300.


In addition to baseline IOPS capacity, gp2 volumes also deliver burst capacity up to 3,000 IOPS for extended periods of time. The burst feature is limited to volumes equal to or less than 1 TiB of storage. DB instances for MySQL, MariaDB, Oracle, and PostgreSQL can be configured with 20 GiB–32 TiB, but the max baseline IOPS is limited from 100 to 16,000 IOPS. So, a gp2 volume of 5.34 TiB or more delivers the same baseline: 16,000 IOPS.


If your production work requires high OLTP, and fast, stable output performance, you should configure your DB for io1 volumes. Compared to gp2 volumes, which bring a maximum of 16,000 IOPS, io1 volumes can bring up to 40,000 IOPS in MySQL DB cases, MariaDB, Oracle, and PostgreSQL and up to 32,000 cases for SQL Server.


If you find the IOPS usage pattern is over 16,000, you should change the DB model and change the storage type from gp2 to io1. Amazon RDS also offers magnetic storage, but it is not suitable for OLTP applications that require constant I / O performance and low latency.


Magnetic storage type is not recommended for heavy I / O load because the final limit is less than that of gp2 or io1. The capacity of the IOPS is also limited to a maximum of 1,000 IOPS.


Storage problems :


Using gp2 storage is suitable for various DB tasks. In this type of storage, the builder website reads and writes workloads in such a way that the total value of ReadIOPS and WritIOPS does not exceed the base IOPS capacity at any given time.


Explosive power may be available for a long time. However, after the use of explosive capacity, the high constant rate of reading and writing IOPS lowers the performance of the model. This reduction can be seen in the increase in WritLatency or ReadLatency values. Ideally, gp2 storage is ideal for a single digit millisecond delay, but overuse of IOPS can cause> 10-ms delay.


The following images show the increased rates of WritLatency as WritIOPS consistently maintains a base capacity of 300 IOPS in the Amazon RDS DB model. In this example, an example of the Amazon RDS PostgreSQL is hosted on t2.small with a volume of 100-GiB gp2.


Why RDS for the Right Size?


Promoting the right size can be performance enhancement or cost reduction or both. It is quite common for performance to be prioritised over costs, which can result in overdue capacity and more $$ spent on resource utilisation.


The Right Size is an ongoing process


Proper rating is an ongoing process and should be flexible and mature with your application. There are many reasons to continue such as:


  1. Application architecture updates (New SQL patterns introduced by updates to the workload source code).

  2. Responding to changes in usage and workload patterns.

  3. A new generation of instance type/family available.

  4. A new engine or kernel upgrade.

  5. A database version upgrade.



You should check items 1 and 2 quite often. Once a sprint, once a month or whatever works for you. You should also monitor your RDS metrics and set alarms as appropriate.


You can look at items 3, 4, and 5 less frequently. Quarterly or yearly work well for many RDS users.


Regions and Availability Zones :

  • The AWS resources are housed in highly available data centers, which are located in different areas of the world. This “area” is called a region.

  • Each region has multiple Availability Zones (AZ), they are distinct locations which are engineered to be isolated from the failure of other AZs.

  • You can deploy your DB Instance in multiple AZ, this ensures a failover i.e. in case one AZ goes down, there is a second to switch over to. The failover instance is called a standby, and the original instance is called the primary instance.


Security Groups :


  • A security group controls the access to a DB Instance. It does so by specifying a range of IP addresses or the EC2 instances that you want to give access.

  • Amazon RDS uses 3 types of Security Groups:

  1. VPC Security Group


It controls the DB Instance that is inside a VPC.


  1. EC2 Security Group


It controls access to an EC2 Instance and can be used with a DB Instance.


  1. DB Security Group


It controls the DB Instance that is not in a VPC.


DB Parameter groups :


  • It contains the engine configuration values that can be applied to one or more DB Instances of the same instance type.

  • If you don’t apply a DB Parameter group to your instance, you are assigned a default Parameter group which has the default values.


DB Option groups :


  • Some DB engines offer tools that simplify managing your databases.

  • RDS makes these tools available with the use of Option groups.


Working with DB parameter groups :


We recommend that you try out DB parameter group changes on a test DB instance before applying parameter group changes to your production DB instances. Improperly setting DB engine parameters in a DB parameter group can have unintended adverse effects, including degraded performance and system instability. Always exercise caution when modifying DB engine parameters and back up your DB instance before modifying a DB parameter group.


For information about backing up your DB instance, see Backing up and restoring an Amazon RDS DB instance.



Scaling Your Amazon RDS Instance Vertically and Horizontally


we look into how we can vertically and horizontally scale your RDS instance. Vertical scaling refers to adding more capacity on your storage and compute of your current RDS instance. In contrast, horizontal scaling refers to adding additional RDS instances for reads and writes.


Vertical scaling :


Vertical scaling is the most straightforward approach to adding more capacity in your database. Several instance sizes are available, from general purpose to CPU and memory optimized. Each instance type includes several instance sizes, which allows you to scale your database to the requirements of your target workload.

The following are some things to consider when scaling up an RDS instance:


  • Before you scale, make sure you have the correct licensing in place for your commercial engine such as Oracle, especially if you Bring Your Own License (BYOL). You can use License Manager to centrally track usage of your Oracle database licenses based on your license agreement terms.

  • Database instance class support varies by database engine and AWS Region.

  • Determine when you want to apply the change. You can apply the change immediately or during the maintenance window specified for the instance.

  • If you have an unpredictable workload, you can manage your storage capacity by enabling Amazon RDS storage autoscaling.

Horizontal scaling

Horizontal scaling allows you to scale beyond the capacity of a single DB instance. An advantage of horizontally scaling in Amazon RDS is that it handles the infrastructure management, provisioning, and configuration of additional nodes. You can easily create additional nodes from the Amazon Retail Database console or API.

Amazon RDS allows you to create read-only copies of your database. When you create a read replica, an Amazon RDS engine manages the asynchronous replication from the primary database.

You can use read replicas to increase performance for read options, for example redirecting the read traffic for business reporting. Another use case is for disaster recovery. Read replicas are not a replacement for the high availability and automatic failover capabilities that Multi-AZ provides.

Before you create a replica, it’s important to understand several factors, such as support for multi-Region deployment and storage types, plus how each database engine performs the replication. 



Each read replica has a unique Domain Name Service (DNS) endpoint. To distribute the read request across multiple read replicas, you use the Amazon Route 53 weighted record sets.


Security :

AWS RDS provides customers with a number of security features to help them secure their data and meet their compliance requirements. These features include:


  • Encryption: RDS uses industry-standard encryption algorithms to encrypt data at rest and in transit.

  • Authentication: RDS supports a number of authentication mechanisms, including IAM authentication, LDAP authentication, and SQL Server authentication.

  • Authorization: RDS provides customers with granular control over who has access to their data.

  • Auditing: RDS logs all database activity, including user and application-level activity.

  • Security groups: RDS customers can use security groups to control access to their RDS resources.

  • IAM roles: RDS customers can use IAM roles to delegate access to their RDS resources.

In addition to the security features provided by RDS, customers can also use a number of other AWS services to further secure their data. For example, they can use Amazon S3 to store their backups, Amazon CloudWatch to monitor their RDS resources, and Amazon EMR to process and analyze their data.



Cost :


RDS AWS is billed based on the following parameters:


  • Instance Class i.e. the type of instance that you are choosing.

  • Running Time i.e. the amount of time an instance is running, partial hours are billed as full hours.

  • Storage i.e. the amount of storage that you have provisioned to your DB Instance

  • I/O Requests per Month i.e. the I/O requests that are made to your DB Instance per month

  • Data Transfer: Data transfer in and out of your DB Instance.

Another way of getting billed for AWS RDS is by reserving some instances.


Reserved Instance is also a way of using AWS RDS, in this, you reserve an RDS Instance for a term, which can be for one or three years by making a one-time payment, it is a less expensive way compared to the monthly bill that one pays.


Free Tier


AWS has an amazing free tier usage for most of its services so that the customer can first use the service and then do the needful.


Similarly, it offers free tier usage for RDS AWS, which includes the following benefits:


  • 750 hours of Amazon RDS usage in single-AZ for db.t2.micro instance, every month for one year from signup.

  • 20 GB of DataBase Storage: any combination of General Purpose (SSD) or Magnetic storage.

  • 10 million IOs

  • 20GB of backup storage



Lowering Cost


With effective monitoring, one could identify and stop any idle RDS instances. This is also something that is easily detected and reported by the AWS Trusted Advisor or the AWS Cost Anomaly Detection (the newest addition to the cost management suite and is under Beta at the moment). If there was a possibility to terminate these, that would even help lower the costs further as we do not need to pay for the EBS volumes. Other strategies such as cutting over to a different instance type or a different instance family also help reduce cost in many cases. For predictable usage patterns, it may also be possible to find time windows (such as overnight or weekends, etc) where you may be able to Scale-In and save on cost.


Reserved Instances can also save you up to 69% over On-Demand rates for instances that must run 24x7x365.


Last (but not least), watch out for new instance families/types and related announcements from AWS which in many cases could translate to a sizeable improvement for performance for the same price or less. For example, AWS just announced m6g and r6g families which provide significantly faster performance at an 11% lower price than their m5 and r5 counterparts.


Database Storage and I/Os :


Amazon Aurora database storage consumption is billed in per GB-month increments, and I/Os consumed are billed in per million request increments. You pay only for the storage and I/Os your Amazon Aurora database consumes and do not need to provision in advance. I/O charges may vary significantly depending on workload and database engine.


Region: US East(Ohio)

Storage Rate – $0.10 per GB-month

I/O Rate – $0.20 per 1 million requests


Global Database :


Amazon Aurora Global Database is an optional feature providing low-latency global reads and disaster recovery from region-wide outages. You pay for replicated write I/Os between the primary region and each secondary region. The number of replicated write I/Os to each secondary region is the same as the number of in-region write I/Os performed by the primary region.


Region: US East(Ohio)

Replicated Write I/Os – $0.20 per million replicated write I/Os


Backup Storage


Backup storage for Amazon Aurora is the storage associated with your automated database backups and any customer-initiated DB cluster snapshots. Increasing your backup retention period or taking DB cluster snapshots increases the backup storage consumed.


Backup storage, as well as snapshots you store after your DB cluster is deleted, will be charged at the following rates:


Region: US East(Ohio)

Backup Storage – $0.021 per GB-month


Backtrack :


Backtrack lets you quickly move an Aurora database to a prior point in time without needing to restore data from a backup. This lets you quickly recover from user errors, such as dropping the wrong table or deleting the wrong row. This feature is currently available for the MySQL-compatible edition of Aurora. 


Region: US East(Ohio)

Change Records – $0.012 per 1 million Change Records(Price Per Hour)


Snapshot Export

Amazon Relational Database Service (RDS) Snapshot Export provides an automated method to export data within an RDS or Aurora snapshot to Amazon Simple Storage Service (Amazon S3) in Parquet format. The Parquet format is up to 2x faster to unload and consumes up to 6x less storage in Amazon S3 compared to text formats.


Region: US East(Ohio)

Charge per GB of snapshot size – $0.010


Data Transfer :


The pricing below is based on data transferred “in” and “out” of Amazon Aurora.

  • As part of the AWS Free Tier, AWS customers receive 100 GB of free data transfer out to the internet free each month, aggregated across all AWS Services and Regions (except China and GovCloud).

  • Data transferred between Amazon Aurora and Amazon Elastic Compute Cloud (Amazon EC2) instances in the same Availability Zone is free. 

  • Data transferred between Availability Zones for DB cluster replication is free. 

  • For data transferred between an Amazon EC2 instance and Amazon Aurora DB instance in different Availability Zones of the same Region, Amazon EC2 Regional Data Transfer charges apply.




No comments:

Post a Comment

Ethical Hacking Techniques: Cracking WPA/WPA2 Wi-Fi Using WPS and Capturing Handshakes

In the realm of cyber security, ethical hacking plays a crucial role in identifying and addressing vulnerabilities. One of the areas where e...