Overview
The RDS Aurora resource creates an Aurora Serverless v2 PostgreSQL cluster with automatic failover and storage encryption. Scheduled secret rotation and RDS Proxy connection pooling are opt-in features.Resource Class
Basic Usage
Configuration Options
Core Properties
Engine Configuration
Writer Configuration
Reader Configuration
Pass
false to create a cluster with no readers.
Proxy Configuration
RDS Proxy is opt-in. Pass a
ProxyConfig object to enable it.
Backup and Maintenance
Security
Snapshot Restore
Database Insights
Default Architecture
The default configuration creates:- 1 Writer instance (Serverless v2)
- 1 Reader instance (Serverless v2, scales with writer)
- Encryption with AWS KMS CMKs
- Database Insights enabled
- Deletion protection enabled
- IAM authentication enabled
proxy configuration.
Secret rotation is not enabled by default. Opt in by passing a rotation config (credentials: { secretRotation: {} } for the 30-day default). Rotation uses the multi-user strategy, which requires a one-time manual step after deploy: populate the generated <id>/master-secret with valid superuser credentials as JSON. Until that secret is populated, every rotation attempt fails and the database password stays unchanged — a synth-time warning reminds you of this when rotation is enabled.
Restoring from Snapshot
Create a new Aurora cluster from an existing cluster snapshot.This password reset only applies to restores performed through infrastructure code (
snapshotIdentifier). Restores performed through AWS Backup (fjall restore rds) run outside CloudFormation and keep the snapshot-era password — see fjall restore.Security Features
Encryption
All data is encrypted using Customer Managed Keys (CMKs) for both storage and Performance Insights.Network Security
Secret Management
Reader Configuration
Default (1 Reader)
Multiple Readers
No Readers
RDS Proxy
RDS Proxy is opt-in. Enable it for connection pooling, failover handling, and reduced database connections.getHostEndpoint() returns the cluster endpoint directly.
Backup and Recovery
Custom Backup Retention
Point-in-Time Recovery
Aurora supports PITR for any point within the backup retention period:- Continuous backup to S3
- Restore to any second within retention period
- Cross-region backup replication available
Monitoring
Enhanced Monitoring
Database Insights
Enabled by default on all instances. Provides:- SQL-level performance metrics
- Top SQL statements
- Database load by waits
Methods
Get Host Endpoint
Get Host Port
Get Credentials
Get Connections
Get Database Cluster
Get CFN Cluster
Complete Example
Cost Optimisation
Serverless v2 Scaling
- ACU (Aurora Capacity Units): 0.5 - 1 ACU minimum
- Automatic scaling: Based on workload
- Per-second billing: Pay only for usage
- Reader scaling: Configure based on read patterns
Cost Comparison
Best Practices
- Enable RDS Proxy when your application has many short-lived connections
- Database Insights is enabled by default for monitoring
- Configure appropriate backup retention (default 14 days)
- Use readers for analytics and reporting queries
- Monitor ACU usage to optimise costs
- Deletion protection is enabled by default for production safety
- Review security group rules regularly
Limitations
- Minimum 0.5 ACU per instance (~$43/month)
- PostgreSQL 16.6 (upgrades require planning)
- Cross-region replicas require Global Database (see RdsAuroraGlobal)
Next Steps
RDS Instance
Deploy a single-instance PostgreSQL or MySQL database when you do not need Serverless v2 scaling.
Database Factory
Provision Aurora, RDS Instance, DynamoDB, or ClickHouse from one declarative factory.
Security Group
Control which applications and CIDRs can reach the cluster on port 35255.
Secrets Manager
Read the generated database credentials and configure rotation.