Cheat sheet
This cheat sheet summarizes the key points from this chapter:
- AWS databases such as RDS and DynamoDB can be encrypted at rest and in transit.
- RDS uses SSL/TLS to encrypt data in transit, so you will need to download and install the right certificate in your application to allow it to connect.
- Databases should be placed in a private subnet within your VPC.
- You should use security groups to tightly control which source IPs are allowed to connect to the database. They should not be left as 0.0.0.0/0 (everywhere).
- Bastion hosts or jump boxes can be used to allow administrative traffic to the databases while maintaining a private subnet for the database.
- AWS Secrets Manager can store database credentials securely and rotate them on a schedule.
- Your applications can be written to request the password from AWS Secrets Manager rather than requiring the database password to be hardcoded within the application configuration files.
- Database auditing...
