AWS RDS Start and Stop Policy

Here’s a IAM policy that you can add to an IAM user or an IAM role so they are able to start and stop a specific RDS instance.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "rds:db-tag/Application": "application-name"
                }
            },
            "Action": [
                "rds:DescribeDBInstances",
                "rds:StartDBInstance",
                "rds:StopDBInstance"
            ],
            "Resource": "arn:aws:rds:us-east-1:xxxxxxxxxxxx:db:db-instance-name",
            "Effect": "Allow"
        }
    ]
}

AWS Backup

AWS just introduced Backup, a new managed service for backing up AWS resources. You can now create backup policies of EC2, RDS, DynamoDB, and EFS systems. The default backup uses S3 buckets, but storage can be moved to Glacier or it can be expired. The backup service is initially available in Virginia, Ohio, Oregon and Ireland.

AWS Backup

Limitations when Stopping RDS

There are several cases where there will be a need to stop a RDS instance. It could be due to testing, development activity, or simply to save money. Whatever the reasons may be, you’ll need to be aware of the limitations when stopping RDS instances. Here are several cases where it may become an issue.

  • You can’t stop a DB instance that has a Read Replica, or that is a Read Replica.
  • You can’t stop a DB instance that is in a Multi-AZ deployment.
  • You can’t stop a DB instance that uses Microsoft SQL Server Mirroring.
  • You can’t modify a stopped DB instance.
  • You can’t delete an option group that is associated with a stopped DB instance.
  • You can’t delete a DB parameter group that is associated with a stopped DB instance.

AWS RDS Patching

RDS is a managed service by AWS. Patching is performed infrequently. Sometimes, it takes a few months. AWS performs these updates during the maintenance period. If no maintenance period was specified during DB creation, it will be assigned a default period. When patching is performed, AWS may need to stop and reboot your RDS instance right after patches are applied. To avoid potential downtime, make sure your RDS instances are configured in a Multi-AZ environment. Patching will be applied on each RDS instance separately, therefore avoiding downtime for your application.