Security
Network isolation
Aurora runs in Amazon VPC, isolating your database in your own virtual network. You can connect to your
on-premises IT infrastructure using industry-standard encrypted IPsec VPNs and configure firewall settings to
control network access to your DB instances.
Resource-level permissions
Aurora integrates with AWS IAM to give you fine-grained access control over the actions that your IAM
users and groups can take on specific Aurora resources (for example, DB instances, DB snapshots, DB parameter
groups, DB event subscriptions, DB option groups). You can tag your Aurora resources and control actions taken
on groups of resources that have the same tag and tag value. Additional information is available in IAM
database authentication documentation.
Encryption
Aurora encrypts your data at rest using keys you create and control through AWS KMS. When encryption is
enabled, data stored at rest in the underlying storage is encrypted, as are the automated backups, snapshots,
and replicas in the same cluster. Aurora uses SSL (AES-256) to secure data in transit.
Advanced auditing
Aurora logs database events with minimal impact on database performance. You can analyze logs for database
management, security, governance, regulatory compliance, and other purposes. You can also monitor activity by
sending audit logs to Amazon CloudWatch.
Threat detection
Amazon GuardDuty offers threat detection for Aurora to help you identify potential threats to data stored in
Aurora databases. GuardDuty RDS Protection profiles and monitors login activity to existing and new databases
in your account and uses tailored ML models to accurately detect suspicious logins to Aurora databases. If a
potential threat is detected, GuardDuty generates a security finding that includes database details and rich
contextual information on suspicious activity. Aurora integration with GuardDuty provides direct access to
database event logs without requiring you to modify your databases and has no impact on database
performance.
