Secure and resilient
Defense in depth
At AWS, security is our top priority. We help you keep your data safe with security features from the core underlying database engine to the perimeter of the database.
Database level
Security starts at the database level with comprehensive encryption. Your data is secured using AES-256 for encryption at-rest and Transport Layer Security for encryption in-transit. As applicable, AWS provides additional security, such as Transparent Data Encryption, which allows encryption for database extensions without requiring application code changes and support for SELinux, which limits what processes and users can access on a system.
Access level
Access control builds on AWS Identity and Access Management (IAM) to control permissions. Through IAM, you can create identity-based, resource-based, managed, and custom policies to determine who can access your database resources and what actions they can perform that match your security requirements.
Perimeter level
At the perimeter level, network isolation keeps your databases secure within your virtual private cloud. Private endpoints ensure data never traverses the public internet, while security groups and network ACLs provide defense-in-depth protection. In addition, Amazon GuardDuty uses machine learning to detect and alert on potential security threats, adding intelligent threat detection to your database security.

Database resilience
Database resilience refers its ability to maintain functionality when faced with disruptions and recover from failures to maintain data availability and integrity.
Fundamentals
A few ways AWS Databases improve resilience include automated backup capabilities to support data restoration, point-in-time recovery (PITR) to restore to any point within your configured retention period, and cross-Region backup copying to provide additional protection against Regional events. Sophisticated monitoring capabilities contribute to database resilience as early detection and timely intervention can prevent disruptions, even in the face of unexpected events. AWS Databases have native integration with CloudWatch to provide real-time metrics and logs, custom alerts, and dashboards that help you maintain visibility into your database operations. Within a single Region, Multi-AZ deployments protect against infrastructure failures by automatically replicating data across multiple Availability Zones with synchronous replication ensuring zero data loss during failovers.
Active-active high availability
For applications that must always be available, AWS offers active-active, multi-Region with strong consistency databases with up to 99.999% availability – Aurora DSQL and DynamoDB global tables – that lets the application read and write to any Regional endpoint. Strong consistency ensures applications will always read the same data from any Region. As failovers are automated, applications remain available even if it is unable to connect to a Regional endpoint, enabling you to achieve zero recovery point objective. In use cases that require up to 99.999% availability but strong consistency isn’t required, DynamoDB global tables, Amazon Keyspaces, and Amazon MemoryDB have active-active, multi-Region replication with eventual consistency, which is an efficient way to serve geographically dispersed end users.
Improved disaster recovery posture
For multi-Region use cases, you can create asynchronous replicas in up to five AWS Regions and promote any to primary in under 1 minute in the rare event of a Regional degradation or outage. These databases – Aurora Global Database, ElastiCache Global Datastore, Neptune Global Database – have active-passive replication with typical latency of less than 1 second, using dedicated infrastructure that leaves your database fully available to serve application workloads. In addition to improving your disaster recovery posture, they enable fast local reads with low latency in each Region.
