What's changed: Service coverage: added catalog sections (s4 compute/DB/storage/network, s5 analytics/ML/IoT/media/integration)
2.3Choosing Data Stores and Encryption
Understand the right data store and protection—choosing RDS/Aurora/DynamoDB/S3 storage classes, encryption with KMS, Secrets Manager, and encryption at rest/in transit. Select secure stores that fit requirements.
Choose data stores by access pattern: relational = RDS/Aurora, key-value/large low-latency = DynamoDB, objects = S3. All can be encrypted with KMS.
2.3.1Data stores and encryption
- RDS/Aurora: relational/transactional; Multi-AZ for HA, read replicas for read scaling.
- DynamoDB: key-value, large-scale low-latency; serverless, global tables for multi-region.
- S3 storage classes: optimize cost with Standard/Intelligent-Tiering/Glacier by access frequency.
- KMS / Secrets Manager: KMS for at-rest (envelope) encryption; Secrets Manager to store and auto-rotate credentials.
Common on SAP-C02: relational = RDS/Aurora, key-value/ultra-low-latency/serverless = DynamoDB, objects + tiered cost optimization = S3 storage classes (Intelligent-Tiering/Glacier), key management/at-rest encryption = KMS, DB password auto-rotation = Secrets Manager. Derive the store from the access pattern.
For unpredictable access, S3 Intelligent-Tiering auto-tiers to optimize cost; for rarely accessed long-term archives, the Glacier classes are cheapest.
Derive the data store from the access pattern. Relational/transactional = RDS/Aurora (Aurora’s distributed storage, up to 15 read replicas, Global Database cross-region, Serverless v2); key-value/ultra-low-latency/serverless = DynamoDB (partition key design, on-demand/provisioned, microseconds via DAX, global tables); analytics/DWH = Redshift; full-text search = OpenSearch; caching = ElastiCache; objects = S3 (classes Standard/Intelligent-Tiering/Standard-IA/One Zone-IA/Glacier Instant·Flexible·Deep Archive; auto-transition via lifecycle policies). Protect with KMS (envelope encryption, CMKs, automatic key rotation, SSE for S3/EBS/RDS) and TLS in transit; manage credentials in Secrets Manager (auto-rotation; config in SSM Parameter Store). Control access with IAM / resource policies / VPC endpoint policies; address data sovereignty via region choice. Pick by requirement: “unpredictable access = Intelligent-Tiering,” “archive = Glacier,” “microsecond reads = DAX,” “password auto-rotation = Secrets Manager.”
| Access pattern | Store | Key point |
|---|---|---|
| Relational/transactional | RDS / Aurora | Multi-AZ, read replicas, Global DB |
| Key-value, ultra-low-latency | DynamoDB (+ DAX) | Serverless, global tables |
| Objects/large | S3 (storage classes) | Intelligent-Tiering/Glacier |
| Analytics/DWH | Redshift | Columnar, large aggregation |
Scenario: read/write global game player data at single-digit ms (microseconds for hot data) with low latency from multiple regions. → Choose DynamoDB (global tables for multi-region active-active) and front it with DAX for ultra-fast reads. Encrypt with KMS (at rest) + TLS (in transit) and auto-rotate app DB credentials with Secrets Manager.
FAQ: Q. KMS vs Secrets Manager? → A. KMS manages keys/encryption; Secrets Manager stores and auto-rotates credentials (passwords/connection strings). Q. S3 data with unpredictable access? → A. Intelligent-Tiering auto-tiers; with known rules, transition to Glacier classes via lifecycle policies.
Trap: “use KMS to store and auto-rotate credentials” is wrong—KMS manages keys/encryption; credential storage and auto-rotation is Secrets Manager. Also “choose RDS for ultra-low-latency key-value” is wrong—key-value at single-digit ms is DynamoDB, microseconds is DAX.
2.3.2Section summary
- Choose = RDS/Aurora (relational) / DynamoDB (key-value) / S3 (objects)
- Protect = KMS (encryption) + Secrets Manager (credential rotation)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want a single-digit-millisecond, virtually unlimited key-value store with no server management. What?
Q2. You want to auto-optimize storage cost for objects with unpredictable access, without operational effort. Which S3 option?
Q3. You want DB credentials kept out of code, securely managed, and auto-rotated. What do you use?