Skip to main content

Overview

The RDS Aurora resource creates an Aurora Serverless v2 PostgreSQL cluster with automatic failover and storage encryption. Scheduled secret rotation and RDS Proxy connection pooling are opt-in features.

Resource Class

Basic Usage

Configuration Options

Core Properties

Engine Configuration

Writer Configuration

Reader Configuration

Pass false to create a cluster with no readers.

Proxy Configuration

RDS Proxy is opt-in. Pass a ProxyConfig object to enable it.

Backup and Maintenance

Security

Snapshot Restore

Database Insights

Default Architecture

The default configuration creates:
  • 1 Writer instance (Serverless v2)
  • 1 Reader instance (Serverless v2, scales with writer)
  • Encryption with AWS KMS CMKs
  • Database Insights enabled
  • Deletion protection enabled
  • IAM authentication enabled
RDS Proxy is not created by default. Enable it by passing a proxy configuration. Secret rotation is not enabled by default. Opt in by passing a rotation config (credentials: { secretRotation: {} } for the 30-day default). Rotation uses the multi-user strategy, which requires a one-time manual step after deploy: populate the generated <id>/master-secret with valid superuser credentials as JSON. Until that secret is populated, every rotation attempt fails and the database password stays unchanged — a synth-time warning reminds you of this when rotation is enabled.

Restoring from Snapshot

Create a new Aurora cluster from an existing cluster snapshot.
Key constraints when restoring from a snapshot:
  • The master username is immutable and baked into the snapshot. snapshotUsername must match the original cluster’s username exactly.
  • The engine version is inherited from the snapshot. A mismatch between the snapshot’s engine version and the infrastructure code will cause a CloudFormation failure.
  • The master password is reset shortly after the restore. Fjall generates a new credentials secret for the restored cluster, and CloudFormation applies its password once the cluster becomes available (the cluster briefly reports resetting-master-credentials). The snapshot-era password stops working at that point — applications must read credentials from the generated secret.
This password reset only applies to restores performed through infrastructure code (snapshotIdentifier). Restores performed through AWS Backup (fjall restore rds) run outside CloudFormation and keep the snapshot-era password — see fjall restore.

Security Features

Encryption

All data is encrypted using Customer Managed Keys (CMKs) for both storage and Performance Insights.

Network Security

Secret Management

Reader Configuration

Default (1 Reader)

Multiple Readers

No Readers

RDS Proxy

RDS Proxy is opt-in. Enable it for connection pooling, failover handling, and reduced database connections.
When proxy is disabled (the default), getHostEndpoint() returns the cluster endpoint directly.

Backup and Recovery

Custom Backup Retention

Point-in-Time Recovery

Aurora supports PITR for any point within the backup retention period:
  • Continuous backup to S3
  • Restore to any second within retention period
  • Cross-region backup replication available

Monitoring

Enhanced Monitoring

Database Insights

Enabled by default on all instances. Provides:
  • SQL-level performance metrics
  • Top SQL statements
  • Database load by waits

Methods

Get Host Endpoint

Get Host Port

Get Credentials

Get Connections

Get Database Cluster

Get CFN Cluster

Complete Example

Cost Optimisation

Serverless v2 Scaling

  • ACU (Aurora Capacity Units): 0.5 - 1 ACU minimum
  • Automatic scaling: Based on workload
  • Per-second billing: Pay only for usage
  • Reader scaling: Configure based on read patterns

Cost Comparison

Best Practices

  1. Enable RDS Proxy when your application has many short-lived connections
  2. Database Insights is enabled by default for monitoring
  3. Configure appropriate backup retention (default 14 days)
  4. Use readers for analytics and reporting queries
  5. Monitor ACU usage to optimise costs
  6. Deletion protection is enabled by default for production safety
  7. Review security group rules regularly

Limitations

  • Minimum 0.5 ACU per instance (~$43/month)
  • PostgreSQL 16.6 (upgrades require planning)
  • Cross-region replicas require Global Database (see RdsAuroraGlobal)

Next Steps

RDS Instance

Deploy a single-instance PostgreSQL or MySQL database when you do not need Serverless v2 scaling.

Database Factory

Provision Aurora, RDS Instance, DynamoDB, or ClickHouse from one declarative factory.

Security Group

Control which applications and CIDRs can reach the cluster on port 35255.

Secrets Manager

Read the generated database credentials and configure rotation.