Turning up Security on Database Services Part 5

In this article, we explore the security designs implemented in various AWS database services. We cover MemoryDB for Redis, DocumentDB, Keyspaces for Apache Cassandra, and Neptune. Each service leverages unique AWS-managed features—such as VPC isolation, IAM-based authentication, encryption, and detailed monitoring—allowing you to architect secure solutions tailored to your needs.

MemoryDB for Redis

MemoryDB for Redis is a fully managed, persistent in-memory database service that runs a Redis-compatible engine. It employs a primary-replica architecture where a primary node handles write operations while replica nodes serve read requests through a configuration endpoint.

The design follows recognized AWS patterns:

• Replication across multiple availability zones.
• Microsecond read latencies comparable to ElastiCache.
• Support for Redis Access Control Lists (ACLs) to enforce command- and key-level permissions. Note that while IAM policies control resource-level access (e.g., console/API operations), Redis ACLs strictly manage access within the database.

IAM policies provide resource-level access control, while Redis ACLs define granular command and key permissions independently of encryption.

For network security, MemoryDB for Redis relies on VPC interface endpoints (as opposed to gateway endpoints) for private connectivity via PrivateLink. These endpoints, positioned behind a network load balancer, enable integration with services such as Lambda and SNS.

Key aspects regarding VPC endpoint integration include:

• Support for VPC interface endpoints for private connectivity.
• Non-support of gateway endpoints.
• Utilization of standard AWS data transfer paths without bypass or acceleration.

Security Features

MemoryDB for Redis offers robust encryption and security:

• Encryption at rest using AWS Key Management Service (KMS).
• Encryption in transit via TLS.
• Use of Redis ACLs for detailed command and key-level control.

For event monitoring, MemoryDB for Redis emits cluster events that can be captured with CloudWatch, CloudTrail, and delivered via SNS notifications.

DocumentDB

Amazon DocumentDB is a MongoDB-compatible document database service that provides native username/password authentication for client connections. For administrative operations, access is governed by IAM roles.

DocumentDB operates in a primary-replica configuration within a VPC, leveraging security groups, Network ACLs, and VPC isolation. Note that the default port for MongoDB (and DocumentDB) is 27017.

Client-Side Field Encryption

DocumentDB supports client-side field encryption processed by the MongoDB driver. When querying an encrypted field, the process involves:

1. Detecting the encrypted field.
2. Requesting the required encryption key from an external key manager (typically AWS KMS).
3. Encrypting the field before query submission.
4. Decrypting the response on the client side using the decryption key.

To implement this encryption:

• Create an encryption key using AWS KMS.
• Associate the key with an appropriate IAM role.
• Configure your application to interact with AWS KMS during CRUD operations.

DocumentDB provides encryption both at rest and in transit via TLS.

Monitoring and Detection

DocumentDB leverages CloudWatch for performance monitoring. CPU utilization is typically the first metric that indicates cluster activity. Additionally, a built-in profiler logs slow operations to diagnose performance issues. Audit logs further support detailed tracking of database events.

Keyspaces for Apache Cassandra

Amazon Keyspaces is an AWS-managed service that is compatible with Apache Cassandra. It exclusively uses IAM for both authentication and authorization, in contrast to DocumentDB’s native username/password approach.

For example, the following snippet shows how Secrets Manager is used to manage credentials in the setup script:

--entrypoint aws-sm-cqlsh.sh

Keyspaces relies on IAM roles for secure, granular access rather than long-term static credentials.

AWS manages infrastructure components such as guest OS patching, freeing customers to focus on data and application management.

Security and Encryption

Key security features for Keyspaces include:

• Encryption at rest using AWS KMS (with AWS-managed or customer-managed keys).
• Encryption in transit by default via TLS.

Monitoring is handled by AWS CloudWatch and CloudTrail for capturing logs and metrics. AWS X-Ray and additional custom solutions are typically unnecessary for routine monitoring.

Neptune

Amazon Neptune is a managed graph database service similar to Neo4j. It supports both IAM database authentication and local user authentication for application-level management.

For access control, it is recommended to use IAM for fine-grained, role-based authentication rather than a custom solution. The cluster endpoint of Neptune is located in a private subnet and secured by security groups.

Neptune follows a maintenance paradigm similar to RDS and DocumentDB. Patching occurs during configured maintenance windows. The encryption capabilities in Neptune include:

• Encryption at rest via AWS KMS.
• In-transit encryption using TLS.

Monitoring and Logging

Neptune leverages CloudWatch for monitoring and CloudTrail for auditing API calls. Although native slow query logs are not available, error logs and cluster status events play an essential role in troubleshooting.

For event notifications, Neptune supports various delivery channels (including SNS) without the need for Lambda integration.

Patching for Neptune databases is conducted during scheduled maintenance windows, ensuring controlled updates and minimizing manual intervention.

This comprehensive overview has covered the security design and operational details for MemoryDB for Redis, DocumentDB, Keyspaces for Apache Cassandra, and Neptune. By leveraging AWS-managed features such as VPC isolation, IAM, encryption, and monitoring, you can design robust and secure database architectures on AWS.

For more detailed information, consider exploring:

• AWS Database Services Overview
• Amazon MemoryDB for Redis Documentation
• Amazon DocumentDB Documentation
• Amazon Keyspaces Documentation
• Amazon Neptune Documentation