CLOUD SERVICE · AWS

Amazon RDS Proxy - Amazon RDS Proxy is a managed database proxy that pools and shares connections to supported Amazon RDS and Amazon Aurora databases.

Amazon RDS Proxy sits between applications and supported relational databases to reduce connection overhead, control database connection pressure, and improve connection handling during failover. It provides database-protocol endpoints, integrates with AWS authentication and monitoring services, and operates within an Amazon VPC.

Cloud Services Hub →

What is Amazon RDS Proxy

Read the extensive description

Amazon RDS Proxy provides a managed connection layer between applications and supported Amazon RDS or Amazon Aurora databases. Applications connect to a proxy endpoint using their normal database drivers, while the proxy maintains a pool of connections to the target database. This is particularly useful when application instances or functions create many short-lived connections that would otherwise consume database memory and processing capacity.

The proxy can reuse a database connection across different client connections when transaction and session state allow it. This multiplexing reduces the number of database connections required for a workload, but it does not eliminate connection limits. Transactions hold database connections while active, and certain statements or session settings can pin a client session to a particular backend connection. Test representative application behavior and monitor session pinning before assuming a specific pooling benefit.

Deploy the proxy in a VPC with network access to its database target. Configure subnets and security groups so applications can reach the proxy and the proxy can reach the database port. A proxy is associated with a database target rather than functioning as a general-purpose router across unrelated databases. Applications normally adopt it by changing their database hostname to the proxy endpoint and configuring the appropriate authentication and TLS settings.

Authentication options depend on the database engine and proxy configuration. RDS Proxy supports AWS Secrets Manager credentials and IAM database authentication in supported configurations, including end-to-end IAM authentication where available. Distinguish authentication from the application to the proxy from authentication between the proxy and the database. When using stored credentials, grant the proxy access only to the required secrets and any necessary AWS KMS decryption permissions.

During a supported database failover, the proxy tracks the database target and redirects connections to the available writer. This reduces reliance on application-side DNS refresh and connection recreation, but does not guarantee uninterrupted transactions. In-flight work can fail, and applications still need bounded retries, transaction rollback handling, and idempotency controls. The proxy does not replay failed transactions automatically.

Connection pool settings let engineers limit the database connections used by the proxy and control how long requests wait to borrow one. Tune these settings alongside application concurrency, transaction duration, and database capacity. Use Amazon CloudWatch metrics and proxy logs to investigate connection saturation, borrow latency, authentication failures, and session pinning.

Check engine, version, Region, and topology support before deployment. For supported Aurora configurations, additional proxy endpoints can provide read-only access to readers or connectivity from another VPC. RDS Proxy is not a query cache, a replacement for database scaling, or a universal solution for slow queries; query tuning, indexing, and transaction design remain necessary.

Key Amazon RDS Proxy Features

Managed connection pooling

Maintains database connections and reuses them across client connections when session state permits. This reduces connection establishment overhead and helps protect databases from bursts of short-lived application connections.

Connection pressure controls

Configure the maximum database connection percentage, idle pool behavior, and connection borrow timeout. Requests can wait for an available connection rather than immediately opening more database connections, although they can still time out under sustained saturation.

Failover-aware connectivity

Tracks supported database failovers and directs connections to the available target. Applications must still handle disconnected sessions and failed transactions because the proxy does not provide automatic transaction replay.

Secrets Manager and IAM authentication

Supports database credentials stored in AWS Secrets Manager and IAM database authentication in supported configurations. Configure client-side and database-side authentication separately, and verify engine support before choosing end-to-end IAM authentication.

Private networking and TLS

Exposes endpoints through VPC networking and uses security groups to control access. Require TLS on client connections where appropriate and configure database drivers to validate the server certificate.

Additional proxy endpoints

Create additional endpoints for supported scenarios such as access from another VPC or read-only access to Aurora readers. Read-only endpoints require a compatible Aurora topology and do not inspect SQL to route reads automatically from a read/write endpoint.

Operational visibility

Publishes CloudWatch metrics for client connections, database connections, connection borrowing, and related behavior. Use these metrics with database monitoring to distinguish connection contention from slow SQL or insufficient database capacity.

Session-aware connection reuse

Preserves database session semantics by retaining a backend connection when a session cannot safely be multiplexed. Monitor session pinning and review engine-specific pinning conditions when pooling efficiency is lower than expected.

Amazon RDS Proxy Use Cases

Database access from Lambda functions

Place the proxy between VPC-connected Lambda functions and a supported database to absorb bursts of client connections. Set function concurrency and proxy pool limits together so database demand remains bounded.

Autoscaling application fleets

Use a shared proxy endpoint for applications running on Amazon ECS, Amazon EKS, or Amazon EC2. Pooling reduces connection churn as tasks, pods, or instances start and stop.

More resilient database failover handling

Use the proxy to reduce connection recovery work during supported RDS or Aurora failovers. Combine it with driver timeouts, bounded retries, and idempotent operations rather than relying on the proxy to preserve in-flight transactions.

Separating Aurora reader traffic

For supported Aurora clusters, send suitable read-only workloads to a read-only proxy endpoint and writes to the read/write endpoint. Applications must explicitly choose the endpoint and account for replica lag.

Standardizing database authentication

Adopt IAM authentication where supported or let the proxy retrieve database credentials from Secrets Manager. This can reduce distribution of long-lived database passwords to application runtimes.

Amazon RDS Proxy pricing models

Additional endpoints and supporting services

Additional proxy endpoints incur AWS PrivateLink charges. Budget separately for applicable data transfer, Secrets Manager, AWS KMS, and monitoring charges; database charges are not included in the proxy price.

Aurora Serverless capacity pricing

For supported Aurora Serverless configurations, pricing uses Aurora Capacity Unit hours rather than provisioned-instance vCPU hours. Check the applicable minimum capacity charge and how capacity changes affect billing when estimating a serverless deployment.

Provisioned database capacity pricing

For supported provisioned RDS and Aurora databases, proxy pricing is based on the vCPU capacity of the underlying database instances covered by the proxy. Regional rates, minimum billable capacity, and billing rules apply; resizing the database can change proxy charges even when request volume is unchanged.

Services Amazon RDS Proxy integrates with

A common architecture places VPC-connected Lambda functions or ECS tasks behind an application endpoint and sends their database traffic through RDS Proxy to a supported RDS instance or Aurora cluster. Security groups should explicitly permit application-to-proxy traffic and proxy-to-database traffic on the database port. Keep application connection pools small enough that scaling the compute fleet does not create excessive client connections.For authentication, applications can use IAM database authentication where supported, while the proxy uses either configured Secrets Manager credentials or supported end-to-end IAM authentication. Secret-backed deployments require an IAM role that can retrieve the selected secrets and decrypt them when necessary. Database users and privileges still control which SQL operations an authenticated session may perform.CloudWatch supplies the operational feedback needed to tune this architecture. Compare client connections, backend connections, borrowing latency, and session pinning with database load. For compatible Aurora deployments, route explicitly selected read-only workloads through a reader endpoint. Across these patterns, retain application-level timeout handling, transaction retries, and idempotency safeguards because connection pooling and failover handling do not guarantee successful transaction completion.

Amazon Aurora

RDS Proxy registers a supported RDS database instance or Aurora cluster as its target and manages connections to that target. For example, an Aurora application can use the default read/write endpoint for transactions and a supported read-only proxy endpoint for reader traffic. Verify engine, version, Region, and topology support before provisioning the proxy.

Open Amazon Aurora →

Amazon CloudWatch

RDS Proxy publishes operational metrics to CloudWatch and can produce diagnostic logs. For example, create alarms for increasing connection borrow latency and compare client connection counts with backend database connections. Enable detailed logging only when needed for diagnosis, considering its performance impact and the sensitivity of logged information.

Open Amazon CloudWatch →

AWS Secrets Manager

In secret-backed configurations, the proxy retrieves database credentials from Secrets Manager using an authorized IAM role. For example, store an application's database username and password in a secret and grant the proxy access to that secret. Coordinate credential rotation with the database and grant decrypt permission when the secret uses a customer-managed KMS key.

Open AWS Secrets Manager →

AWS Fargate

Applications running in ECS tasks, including tasks on Fargate, can connect to the proxy through VPC networking. For example, an autoscaling API service can use a modest local connection pool per task while RDS Proxy manages aggregate backend connections. Keep application pools bounded because the proxy does not remove client connection limits or database throughput constraints.

Open AWS Fargate →

AWS Lambda

VPC-connected Lambda functions can use a proxy endpoint instead of connecting directly to a supported database. For example, an order-processing function can reuse a client connection across warm invocations while the proxy manages backend connection pooling. Coordinate Lambda concurrency with database capacity and configure security groups for the function-to-proxy and proxy-to-database paths.

Open AWS Lambda →