Guided Walkthroughs

Configuration Packages

Custom Packages

By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallRoute53 Resolver SecurityAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSAWS SSOIAM PoliciesVPC Endpoint PoliciesCloudFormation Guard RulesLoad BalancersRDS Event SubscriptionsAWS Resource Access Manager (RAM)

By Service Protected

Reference Guides


RDS Security Controls

RDS MySQL Instance (w/ Secrets Manager)

Configuration template to launch an RDS instance running MySQL. The template also includes a new DB subnet group to specify the subnets for the cluster instances to be created as well as a new AWS Secrets Manager secret to store the password

Settings for customizing the template include:

  • RDS Settings:
    • Engine and Engine Version, DB Instance Type
    • (Aurora) Cluster Name and Number of Instances 
    • (RDS) Allocated Storage and Storage Type
    • (RDS) Enable Multi-AZ 
    • Encryption Storage and Deletion Protection
  • Create a new DB Subnet Group to specify the Subnet Ids for the RDS Cluster or Instance or reference an existing DB Subnet Group for the RDS Cluster or Instance
  • (Optional) Database Settings which include Database Name, Port, Username and Password
    • Password by default is a random string that is generated and stored in AWS Secrets Manager, edit the secret properties using the Edit Secret Settings
    • Optionally provide the password as clear-text (not recommended)
  • Maintenance and Backup options such as Backup Retention Period, preferred Backup and Maintenance Windows
1.0 KB
AWSTemplateFormatVersion: "2010-09-09"
Description: ""
    Type: "AWS::SecretsManager::Secret"
      KmsKeyId: "alias/aws/secretsmanager"
        ExcludeLowercase: false
        ExcludeNumbers: false
        ExcludePunctuation: false
        ExcludeUppercase: false
        PasswordLength: 32
        ExcludeCharacters: "/\"@\\"
    Type: "AWS::RDS::DBInstance"
      DBInstanceClass: "db.t3.medium"
      MultiAZ: false
      Engine: "mysql"
      EngineVersion: "8.0.25"
      DBSubnetGroupName: "custom-subnet-group"
      MasterUsername: "dbadmin"
        Fn::Sub: "{{resolve:secretsmanager:${DbSecret}}}"
      Port: "3306"
      DBInstanceIdentifier: "rds-mysql"
      AllocatedStorage: "50"
      StorageEncrypted: false
      StorageType: "standard"
      BackupRetentionPeriod: 1
      DeleteAutomatedBackups: true
      DeletionProtection: false
Parameters: {}
Metadata: {}
Conditions: {}


Customize Template

RDS Settings

Database Settings

Network Settings

Maintenance & Backup

* Required field

Upgrade to Premium for More Features

Guided Walkthroughs
Step-by-step configuration wizards for your environment
Dedicated Security Account
AWS Backup Strategy
VPC Connectivity Setup
Automated Patching
All Guides
Configuration Packages
Pre-built packages for common configuration
Common SCPs
CloudFormation Guard Rules
Auto Remediation Rules
IAM Monitoring & Compliance
All Packages
Automated Assessments
  • 350+ security checks
  • Well-architected reviews
  • Detailed compliance reports
  • Remediation templates
  • Email summaries
  • Learn more