CertNote/ Commute Study Notes
Roadmap
KOEN
CLF-C02 · FoundationalCloud Practitioner - Foundational
DVA-C02 · AssociateDeveloper - Associate
  • Week 1
    • 1.AWS from a Developer's Perspective: Regions, Infrastructure, and the Boundary of Responsibility
    • 2.The 4 Core Entities of IAM: User, Group, Role, Policy
    • 3.STS and Policy Conditions: The Deep World of Temporary Credentials
    • 4.AWS CLI and SDK: From Credential Chaining to SigV4
    • 5.Week 1 Review: The Chain of Trust Built by Infrastructure and IAM
  • Week 2
  • Week 3
  • Week 4
  • Week 5
  • Week 6
  • Week 7
    • 1.RDS: The Two Faces of a Managed RDBMS, Multi-AZ and Read Replicas
    • 2.RDS Security, Backup, and Monitoring: Lessons Left by the Capital One Incident
    • 3.ElastiCache: How an In-Memory Cache Saves Your Database
    • 4.Aurora: The Story of How AWS Rewrote the Storage Layer of an RDBMS
    • 5.Week 7 Wrap-Up: Everything About Data-Tier Decisions
  • Week 8
  • Week 9
  • Week 10
  • Week 11
  • Week 12
  • Week 13
SAA-C03 · AssociateSolutions Architect - Associate
SOA-C02 · AssociateCloudOps Engineer - Associate
SAP-C02 · ProfessionalSolutions Architect - Professional
DOP-C02 · ProfessionalDevOps Engineer - Professional
Linux Master 2 · 2급KAIT Linux Master - Level 2
SCS-C03 · SpecialtySecurity - Specialty
Linux Master 1 · 1급KAIT Linux Master - Level 1
MLA-C01 · AssociateMachine Learning Engineer - Associate
AIF-C01 · FoundationalAI Practitioner - Foundational
DEA-C01 · AssociateData Engineer - Associate
MLS-C01 · SpecialtyMachine Learning - Specialty
SQLD · 개발자SQL Developer (SQLD)

© CertNote · 주간랩스

  • About
  • Changelog
  • Contact
  • Terms
  • Privacy
← DVA-C02/Week 7/Day 5

Based on the DVA-C02 exam guide·Report an error

DVA-C02· AssociateWeek 7 · Day 5~41 min read

Day 5 - Week 7 Wrap-Up: Everything About Data-Tier Decisions

This week we went through the 3 major axes of AWS's data tier: RDS, ElastiCache, and Aurora. We saw that each solves a different problem and has different trade-offs. RDS is the first-generation managed DB that delegates the operational burden of relational databases to AWS; Aurora is the second generation, one step above, that redesigned the storage and replication layers to be cloud-native; and ElastiCache is the complement that provides an in-memory cache tier on top of both.

Data-domain questions on the DVA-C02 exam follow a fixed mold. They ask in scenario form, "given these requirements (availability, latency, cost, scalability, consistency), which service do you configure and how?" Today we regroup this week's content around scenarios and do a comprehensive check with 12 practical scenario questions.

Decision Framework: 5 Steps for Choosing a Data Tier

The thought flow you go through when deciding on a data tier in production is the following 5 steps. It applies directly to analyzing exam scenarios too.

Step 1: Data model
  └─ Relational (needs JOINs, transactions)      → RDS / Aurora
  └─ Key-value (mostly single-entity lookups)    → DynamoDB / ElastiCache
  └─ Document, time-series, graph, etc.          → DocumentDB / Timestream / Neptune

Step 2: Consistency requirement
  └─ Strong consistency (ACID needed)            → RDS / Aurora / MemoryDB
  └─ Eventual consistency acceptable             → DynamoDB / ElastiCache Replica

Step 3: Latency requirement
  └─ μs (microseconds)                           → ElastiCache / MemoryDB / DAX
  └─ ms (single-digit milliseconds)              → Aurora primary / DynamoDB
  └─ A few ms to tens of ms                      → RDS / Aurora Replica / S3

Step 4: Availability and DR requirement
  └─ Single AZ OK                                → Basic RDS Single-AZ
  └─ Automatic AZ failure recovery (RTO in minutes) → RDS Multi-AZ
  └─ Cross-region DR (RTO in minutes)            → Aurora Global / DynamoDB Global Tables

Step 5: Cost model
  └─ Steady traffic                              → Reserved Instance (~50-70% savings)
  └─ Variable traffic                            → Aurora Serverless v2 / DynamoDB On-Demand
  └─ Dev/staging                                 → Single-AZ + Reserved (or Serverless auto-pause)

RDS, ElastiCache, Aurora Compared: The Same Question, Different Answers

The Three Services' Answers to "High Availability"

ServiceMechanismFailover timeRPO
RDS Multi-AZ InstanceBlock-level synchronous replication (1 standby)60-120 seconds~0
RDS Multi-AZ ClusterSynchronous quorum (2 readable standbys)35 seconds or less~0
ElastiCache Redis Multi-AZPrimary-Replica + sentinel60 seconds or lessreplica lag
Aurora Multi-AZ6-copy quorum30 seconds or less~0
Aurora Global DatabaseRedo log shipping (cross-region)On the order of minutes (managed failover)Under 1 second

The Three Services' Answers to "Read Scaling"

ServiceMechanismMax countReplication lag
RDS Read Replicabinlog/WAL asynchronous15 (MySQL/PG/MariaDB)Seconds to minutes
ElastiCache Redis ReplicaRedis replication5 per shardms
Aurora ReplicaRedo log notification (shared storage)15Usually much less than 100 ms

Answers for "Password/Key Management"

ToolWhat it protectsRotationRDS compatible
AWS KMSData encryption keysAutomatic (1 year)✅ at-rest
Secrets ManagerPasswords, API keysAutomatic (Lambda or native)✅
IAM DB AuthenticationRemoves the password itselfN/A (15-minute token)✅ MySQL/PG
Parameter StoreGeneral config values (SecureString also possible)Manual△ (possible but no rotation)

15 Exam Pitfalls Summarized

A collection of easy-to-confuse traps.

  1. A Multi-AZ Standby can't be read from: though Multi-AZ Cluster Deployment (2022~) provides 2 readable standbys
  2. Encryption conversion = snapshot → KMS copy → restore: direct modify is not possible
  3. Setting automatic backups to 0 days blocks both PITR and Read Replica creation
  4. IAM DB Auth token = 15-minute SigV4, SSL required
  5. When a DB is deleted, automatic backups are deleted with it (Final Snapshot option is essential), while manual snapshots are retained
  6. Reading right after a write on a Read Replica = stale data (a Read-Your-Writes violation is possible)
  7. Aurora Replica automatic failover < 30 seconds, RDS Multi-AZ is 60-120 seconds
  8. Aurora storage = 3 AZ × 2 copies = 6, W=4 R=3
  9. Aurora Serverless v1 is minute-granular + cold start, v2 is fine-grained + non-disruptive scaling (about 15 s to resume from auto-pause)
  10. Redis Cluster Mode Disabled is a single shard: one node's memory is the limit
  11. Memcached has no persistence, backup, Multi-AZ, or replication
  12. Redis Sorted Set = the leaderboard answer (ZADD/ZREVRANK O(log N))
  13. DAX is DynamoDB-only, ElastiCache is general-purpose (they can't substitute for each other)
  14. RDS Proxy = the number-one fix for Lambda + RDS connection storms
  15. Aurora Backtrack = MySQL only, 72 hours in-place (a different mechanism from PITR)

⚠️ Pitfall example 1 - automatic backup retention of 0 days: If you set the retention period to 0 days with the intent of "turning off" automatic backups, PITR becomes impossible at that moment and Read Replica creation is also blocked. Exam question: "What is the cause of a failed Read Replica creation attempt?" → automatic backups are disabled. Fix: set the retention period to 1 day or more.

⚠️ Pitfall example 2 - maximum Aurora vs RDS Read Replica count: An Aurora cluster allows up to 15 Aurora Replicas, and RDS also allows up to 15 per source for MySQL/PostgreSQL/MariaDB/SQL Server. Oracle follows its own engine documentation. When a simple question like "maximum number of RDS Read Replicas" appears on the exam, you must answer by looking at the engine.

Practical Patterns: Scenario Mapping

Scenario keywordsAnswer
"Lambda + RDS + connection spike"RDS Proxy
"Automatic password rotation + zero downtime"Secrets Manager rotation
"Remove the password itself from code"IAM DB Authentication
"Instantly recover from DROP TABLE (Aurora MySQL)"Backtrack
"Recover yesterday's data after DROP TABLE"PITR
"Keep backups even after the DB is deleted"Manual snapshot / Final Snapshot
"Query wait event analysis"Performance Insights
"OS process-level monitoring"Enhanced Monitoring
"Leaderboard/ranking caching"Redis Sorted Set
"Share sessions across multiple EC2 instances"ElastiCache Redis
"DynamoDB cache"DAX
"Global RDBMS + under 1 second lag"Aurora Global Database
"Global NoSQL + multi-master"DynamoDB Global Tables
"Intermittent RDB traffic + auto scaling"Aurora Serverless v2
"Store PII + 1-year audit log"Audit log → CloudWatch Logs + KMS
"Ransomware-resistant backup"AWS Backup Vault Lock (WORM)
"Multi-AZ but want to read from the standby"Multi-AZ Cluster Deployment
"Aurora replica load concentrates on only one node"DNS TTL/connection persistence issue, RDS Proxy or cluster-aware client
"Connection failure due to CA certificate expiry"RDS CA rotation, refresh the trust store
"Microsecond latency + DB-level durability"MemoryDB for Redis

Cross-Service Patterns Worth Knowing

Pattern 1: "High-Performance OLTP + Analytics Isolation + DR"

Production Seoul:
  Aurora MySQL Multi-AZ
    ├── Writer endpoint → OLTP traffic
    ├── Reader endpoint → general reads
    └── Custom endpoint (2 large instances) → isolate analytics workloads

DR Tokyo:
  Aurora Global Database secondary
    └── Read-only, minimizes in-region latency
    └── Promote when the primary region goes down (RTO on the order of minutes)

Cache tier:
  ElastiCache Redis Cluster Mode Enabled (Seoul)
    ├── Session data
    ├── Popular product info (Lazy Loading + 5-minute TTL)
    └── Leaderboard (Sorted Set)

Secrets management:
  Secrets Manager + RDS Proxy (on the Lambda function side)
  KMS CMK encrypts storage/snapshots/Secrets all together

This one configuration contains most of this week's concepts.

Pattern 2: "Evolving from Startup MVP to Production"

Phase 1 (MVP):
  RDS MySQL Single-AZ db.t3.micro + local in-memory cache (library)

Phase 2 (traffic growth):
  RDS MySQL Multi-AZ db.t3.medium + ElastiCache Redis (sessions, popular data)

Phase 3 (scale-out):
  Aurora MySQL Multi-AZ + 3 Aurora Replicas + ElastiCache Redis Cluster
  Introduce RDS Proxy (as Lambda functions multiply)

Phase 4 (global):
  Aurora Global Database (Seoul + Tokyo)
  CloudFront + S3 static asset CDN
  ElastiCache Replica in each region

Pattern 3: "Hardened Compliance Environment"

- RDS at-rest encryption (KMS CMK, company-owned key)
- Enforce TLS (rds.force_ssl=1)
- IAM DB Auth + Secrets Manager (human users use IAM, applications use Secrets Manager + RDS Proxy)
- Audit log → CloudWatch Logs (KMS-encrypted) → 1-year retention → S3 archive
- Protect backups with WORM using AWS Backup Vault Lock
- VPC private subnet only, no NAT Gateway (egress blocked)
- Enable CloudTrail data events

This is an example configuration used in environments seeking certifications such as HIPAA, PCI-DSS, and ISO 27001.

Cost View: The Break-Even of Reserved Instances and Serverless

OptionCommitment termCost savings
On-DemandNone0% (baseline)
1-year Standard RI No Upfront1 yearAbout 30%
1-year Standard RI All Upfront1 yearAbout 38%
3-year Standard RI All Upfront3 yearsAbout 60%
Aurora Serverless v2 (steady traffic)None-20% (actually more expensive)
Aurora Serverless v2 (intermittent traffic)None50-80% (0 ACU when unused)

In "cost optimization" scenarios, if the traffic pattern is steady the answer is Reserved Instance, and if it is variable the answer is Serverless. The criterion for variable is roughly "usage differs 5x or more by time of day," and below that the RI is advantageous.

CLI/SDK Quick Reference

# Create RDS (Multi-AZ + encryption + IAM authentication)
aws rds create-db-instance \
  --db-instance-identifier prod-mysql \
  --db-instance-class db.r6g.large \
  --engine mysql --master-username admin \
  --master-user-password "$(aws secretsmanager get-random-password --output text --query RandomPassword)" \
  --allocated-storage 100 --storage-type gp3 \
  --multi-az --storage-encrypted \
  --enable-iam-database-authentication \
  --backup-retention-period 14 \
  --enable-cloudwatch-logs-exports '["audit","error","general","slowquery"]'
 
# Create Aurora Cluster (prepare for Global Database)
aws rds create-global-cluster --global-cluster-identifier my-global \
  --engine aurora-mysql
aws rds create-db-cluster --db-cluster-identifier my-primary \
  --engine aurora-mysql --global-cluster-identifier my-global \
  --master-username admin --master-user-password ... 
aws rds create-db-instance --db-instance-identifier my-primary-instance \
  --db-cluster-identifier my-primary --db-instance-class db.r6g.large \
  --engine aurora-mysql
 
# Add to the secondary region
aws rds create-db-cluster --region us-east-1 \
  --db-cluster-identifier my-secondary \
  --engine aurora-mysql --global-cluster-identifier my-global
 
# ElastiCache Redis Cluster Mode Enabled
aws elasticache create-replication-group \
  --replication-group-id prod-cache \
  --replication-group-description "production cache" \
  --engine redis --cache-node-type cache.r7g.large \
  --num-node-groups 3 --replicas-per-node-group 2 \
  --automatic-failover-enabled --multi-az-enabled \
  --at-rest-encryption-enabled --transit-encryption-enabled \
  --auth-token "$(aws secretsmanager get-random-password ...)"
 
# Create RDS Proxy
aws rds create-db-proxy \
  --db-proxy-name my-proxy \
  --engine-family MYSQL \
  --auth '[{"AuthScheme":"SECRETS","SecretArn":"arn:aws:secretsmanager:..."}]' \
  --role-arn arn:aws:iam::123456789012:role/rdsproxyrole \
  --vpc-subnet-ids subnet-aaa subnet-bbb \
  --require-tls

Wrapping Up

This week's content compresses into two points.

  • Fundamental distributed-systems trade-offs such as "relational vs key-value," "strong vs eventual consistency," and "synchronous vs asynchronous replication" are projected directly onto the choice of AWS data services.
  • For the same problem (availability, scalability, latency), RDS/Aurora/ElastiCache each have a different answer, and the exam asks for "the most appropriate one under the given constraints" among those answers.

Next week we move on to NoSQL: DynamoDB. DynamoDB is a service with an almost opposite philosophy from RDS (automatic sharding, a strong consistency option, unlimited scaling, giving up the relational model). If you understand RDS/Aurora this week, "why was DynamoDB designed so differently" becomes much easier to see.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

A SaaS company runs production RDS MySQL. 500 Lambda functions are invoked concurrently during burst traffic, producing "Too many connections" errors, and the security team also demands all three: "no passwords in code + automatic rotation + connection stability." What is the most appropriate configuration?

Question 2

A fintech company wants an RDS configuration that satisfies all of the following: (1) RPO ≈ 0, (2) analytics queries can run on the standby, (3) failover time < 60 seconds. Which option fits best?

Question 3

In ElastiCache Redis Cluster Mode Enabled, traffic concentrates on one hot key (a popular product ID), so one shard's CPU is at 100% while the other shards are at 5%. What is the most effective fix?

Question 4

A company uses Aurora MySQL, and a developer accidentally ran DELETE FROM orders WHERE created_at > '2024-01-01' on the production DB. What is the fastest recovery method? (within 30 minutes of the incident)

Question 5

A game company runs a real-time leaderboard for global users. It must satisfy all of: (1) sorting 100 million users' scores, (2) a specific user's rank lookup < 10ms, (3) 100,000 score updates per second. What configuration fits best?

Question 6

A healthcare SaaS stores PHI (Protected Health Information) in RDS PostgreSQL. HIPAA audit requirements are: (1) encrypt stored data with a company KMS key, (2) enforce TLS, (3) retain "who ran which query" for 1 year, (4) WORM protection for backups. Which one is missing? Select all of the following items that should be applied: (A) Enable the pgaudit extension + CloudWatch Logs export (B) rds.force_ssl=1 parameter (C) Encrypt the instance with a KMS CMK (customer managed key) (D) Enable AWS Backup Vault Lock

Question 7

An e-commerce company implemented product info caching in ElastiCache Redis in front of Aurora MySQL, using Lazy Loading + a 1-hour TTL. The operations team reports, "even after we change a product price, the old price shows for 1 hour." What is the most appropriate fix?

Question 8

A company runs Aurora MySQL in Tokyo. As global users grow, read latency must be 50ms or less in the US and Europe too, and it must be possible to promote to another region automatically if the Tokyo region goes down. What is the appropriate configuration?

Question 9

A startup wants to cut RDS cost for its dev/staging environment. It is used only 9:00-18:00 on weekdays and not at all on weekends and nights. What is the most cost-effective configuration?

Question 10

A company runs Multi-AZ RDS MySQL. An automatic minor patch ran and caused 4 minutes of downtime at the weekday morning traffic peak. Which of the following is NOT an appropriate way to prevent the same incident in the future?

Question 11

A company uses ElastiCache Redis, and when one node suddenly went down the whole cache emptied, traffic to RDS surged at that moment, and it suffered a cascading failure that took down RDS too. What is the most appropriate configuration to prevent the same incident in the future?

Question 12

In which of the following scenarios is DAX (DynamoDB Accelerator) NOT the answer?

PreviousAurora: The Story of How AWS Rewrote the Storage Layer of an RDBMSWeek 7 · Day 4Next CodeCommit and CodeBuild: The First Two Squares of CI/CD as Drawn by AWSWeek 8 · Day 1

Official references

  • DVA-C02 official exam page(opens in a new tab)
  • Amazon RDS · Aurora documentation(opens in a new tab)
  • Amazon ElastiCache documentation(opens in a new tab)
  • Amazon DynamoDB documentation(opens in a new tab)
  • AWS Lambda documentation(opens in a new tab)
  • AWS IAM documentation(opens in a new tab)

On this page

  • Decision Framework: 5 Steps for Choosing a Data Tier
  • RDS, ElastiCache, Aurora Compared: The Same Question, Different Answers
  • The Three Services' Answers to "High Availability"
  • The Three Services' Answers to "Read Scaling"
  • Answers for "Password/Key Management"
  • 15 Exam Pitfalls Summarized
  • Practical Patterns: Scenario Mapping
  • Cross-Service Patterns Worth Knowing
  • Pattern 1: "High-Performance OLTP + Analytics Isolation + DR"
  • Pattern 2: "Evolving from Startup MVP to Production"
  • Pattern 3: "Hardened Compliance Environment"
  • Cost View: The Break-Even of Reserved Instances and Serverless
  • CLI/SDK Quick Reference
  • Wrapping Up
  • Week 7 Integrated Practical Scenarios: 12 Questions