Rds Operation Review

RDS / Aurora Operational Review

Conduct a comprehensive operational review of Amazon RDS instances and Amazon Aurora clusters aligned with the AWS Well-Architected Framework and the Amazon RDS and Aurora best-practices guides.

This skill uses the AWS RDS, Aurora, CloudWatch, CloudWatch Logs, EC2, and Cost Explorer APIs only — no Kubernetes (k8s) or eks MCP tools. All data is collected through native AWS APIs available to the DevOps Agent's primary cloud source role.

When to Use

Activate this skill when the user asks to:

• Review, audit, or assess RDS instances or Aurora clusters
• Check RDS / Aurora best-practices compliance
• Evaluate database security, cost, reliability, performance, or backups
• Perform an RDS / Aurora operational readiness review (ORR)
• Investigate database health or configuration drift

Step 1: Identify Target Resources

Ask the user which databases to review. Accept:

• Specific instance / cluster identifiers and regions
• "all instances" / "all clusters" in specific regions
• "all RDS in all regions"

If no scope is given, default to all configured account regions.

Step 2: Discover RDS / Aurora Resources

Per region (skip empty regions):

rds.DescribeDBInstances           # RDS instances + Aurora cluster member instances
rds.DescribeDBClusters            # Aurora clusters (skip if user said "Provisioned only")
rds.DescribeDBClusterEndpoints    # Aurora reader/writer endpoints
rds.DescribeGlobalClusters        # Aurora Global Database (cross-region)
rds.DescribeDBProxies             # RDS Proxy

Capture per resource:

• Engine, engineVersion, dbInstanceClass / serverlessV2 capacity
• Multi-AZ, AvailabilityZones, subnetGroup, VpcId
• AllocatedStorage, MaxAllocatedStorage, StorageType, Iops, StorageThroughput, StorageEncrypted, KmsKeyId
• BackupRetentionPeriod, PreferredBackupWindow, PreferredMaintenanceWindow, AutoMinorVersionUpgrade
• DeletionProtection, PubliclyAccessible, IAMDatabaseAuthenticationEnabled
• PerformanceInsightsEnabled, PerformanceInsightsRetentionPeriod, MonitoringInterval (Enhanced Monitoring), MonitoringRoleArn
• EnabledCloudwatchLogsExports, AssociatedRoles
• ReadReplicaSourceDBInstanceIdentifier / ReadReplicaDBInstanceIdentifiers
• Tags (rds.ListTagsForResource — param name is ResourceName and value is the resource ARN)

Step 3: Discover Configuration Dependencies

For each database, collect:

rds.DescribeDBParameterGroups           # custom vs default
rds.DescribeDBClusterParameterGroups    # Aurora
rds.DescribeOptionGroups                # RDS option groups
rds.DescribeDBSubnetGroups              # subnet AZ spread
ec2.DescribeSecurityGroups              # vpcSecurityGroupIds → ingress rules
kms.DescribeKey                         # for KmsKeyId (encryption at rest)

Step 4: Collect Backups, Snapshots, Maintenance

rds.DescribeDBSnapshots                            # manual + automated, per instance
rds.DescribeDBClusterSnapshots                     # Aurora
rds.DescribeDBInstanceAutomatedBackups
rds.DescribeDBClusterAutomatedBackups
rds.DescribeDBEngineVersions                       # current vs latest minor/major
rds.DescribePendingMaintenanceActions
rds.DescribeEvents                                 # last 14 days; duration in MINUTES (20160)
rds.DescribeEventSubscriptions

For each instance/cluster, also fetch:

• rds.DescribeDBLogFiles — list of logs available locally on the DB
• logs.DescribeLogGroups with prefix:
  • Instances: /aws/rds/instance/<dbInstanceIdentifier>/
  • Aurora: /aws/rds/cluster/<dbClusterIdentifier>/

Step 5: Collect CloudWatch Metrics (7-Day Historical)

One cloudwatch.GetMetricData call per resource. Period: 21600 (6 hours). StartTime: 7 days ago. EndTime: now.

5.1 RDS Instances (dimension DBInstanceIdentifier)

5.2 Aurora Clusters (dimension DBClusterIdentifier)

5.3 Per-Instance Aurora Members

Same instance metrics as 5.1, dimensioned by DBInstanceIdentifier of each cluster member.

Fetch cloudwatch.DescribeAlarmsForMetric for the key metrics (CPUUtilization, FreeStorageSpace, DatabaseConnections, ReadLatency, WriteLatency, ReplicaLag / AuroraReplicaLag) per resource so the report can flag missing alarms.

Step 6: Collect Logs (7-Day)

Per database log group, scan with logs.FilterLogEvents for:

Record occurrence counts per pattern over the 7-day window.

Step 7: Collect CloudTrail-Visible RDS Events

Use rds.DescribeEvents (last 14 days) per resource — covers the same operational signal as CloudTrail for RDS without an extra API permission. Look for: failover, restart, parameter group apply, out-of-memory, storage-full, low-storage, automated-backup-failed, maintenance-related events, read replica error, instance stopped.

Step 8: Cost Data

Once per review (not per resource):

costexplorer.GetCostAndUsage     # 3 months, by USAGE_TYPE,
                                 # filter Service = "Amazon Relational Database Service"
rds.DescribeReservedDBInstances  # RI inventory

Estimate per-database monthly cost as a proportional split of the latest month total (Cost Explorer doesn't break down per DB):

1. Get the most recent full month total RDS spend.
2. Per resource, weight by vCPUs(instance class) × (Multi-AZ ? 2 : 1) + allocatedStorageGB.
3. For Aurora clusters, sum across cluster member instances; storage is cluster-shared.
4. Note the estimate in the report with an "estimated" badge.

Step 9: Analyze Against Best Practices

Evaluate ALL collected data across the five Well-Architected pillars and assign a severity to every finding: CRITICAL, HIGH, MEDIUM, LOW, or INFO.

9.1 Security

Ref: Security in Amazon RDS

• Network exposure: PubliclyAccessible=true → CRITICAL for production. Security groups with 0.0.0.0/0 ingress on the DB port → CRITICAL.
• Encryption at rest: StorageEncrypted=false → HIGH (or CRITICAL for regulated workloads). Customer-managed KMS key preferred over AWS-managed.
• Encryption in transit: parameter rds.force_ssl=1 (Postgres) / require_secure_transport=ON (MySQL/MariaDB) → MEDIUM if not set.
• IAM auth: IAMDatabaseAuthenticationEnabled=false → MEDIUM. Master password in app code instead of Secrets Manager → HIGH.
• Secrets Manager rotation: not enabled → MEDIUM.
• Audit logging: engine audit logs not in EnabledCloudwatchLogsExports → MEDIUM (HIGH for PCI/HIPAA scope).
• CMK rotation: KMS key without automatic rotation → LOW.

9.2 Reliability

Ref: High Availability for Amazon RDS

• Multi-AZ: production single-AZ → HIGH (Aurora: ≥1 reader in a different AZ).
• Subnet group AZ spread: subnets span <2 AZs → HIGH.
• Backups: BackupRetentionPeriod=0 → CRITICAL. <7 days for production → HIGH.
• Deletion protection: production with DeletionProtection=false → HIGH.
• Auto minor version upgrade: AutoMinorVersionUpgrade=false for non-prod → MEDIUM.
• Custom parameter group: instance using default.<engine> parameter group → MEDIUM (can't tune).
• Pending maintenance: required actions not applied within window → MEDIUM, escalating with age.
• Replication health (read replicas): ReplicaLag 7-day max > 30s → HIGH; > 300s → CRITICAL.
• Aurora replicas: clusters with no reader → MEDIUM; single-AZ readers → MEDIUM.
• DR: cross-region read replica or Aurora Global Database absent for tier-1 workloads → MEDIUM.

9.3 Performance

Ref: DB Instance Performance

7-day metric thresholds (full table in references/metrics-thresholds.md):

• CPUUtilization avg > 70% → MEDIUM, > 90% → HIGH.
• FreeStorageSpace < 20% allocated → HIGH, < 10% → CRITICAL.
• FreeableMemory < 10% instance class memory → HIGH; sustained SwapUsage > 0 → MEDIUM.
• DatabaseConnections max > 80% of max_connections parameter → HIGH.
• ReadLatency / WriteLatency avg > 20ms (10ms for io1/io2) → MEDIUM.
• BufferCacheHitRatio (Aurora) < 95% → MEDIUM, < 90% → HIGH.
• BinLogDiskUsage growth without retention bounds → MEDIUM.
• Performance Insights disabled → MEDIUM (free 7-day tier should always be on).
• Enhanced Monitoring disabled or interval > 60s for production → MEDIUM.
• Connection pooling: high connection churn / no RDS Proxy → MEDIUM for serverless / many-client workloads.