Security and Compliance
Layer the controls
Think in four layers: network (private subnets, security groups as stateful allow-lists, no public accessibility), identity (IAM policies and roles), credentials (Secrets Manager with rotation rather than hard-coded passwords), and data (KMS encryption at rest, TLS in transit).
Encryption at rest uses KMS keys - either an AWS-managed key or a customer-managed key for granular policy control. On RDS and Aurora, encryption can only be enabled at creation: to encrypt an existing unencrypted instance you snapshot it, copy the snapshot with encryption enabled, and restore. DynamoDB encrypts at rest by default with an AWS-owned key, upgradeable to a CMK.
Authentication and authorization
IAM database authentication issues short-lived tokens for RDS MySQL, MariaDB, PostgreSQL, and Aurora - it does not work with SQL Server or Oracle. DynamoDB fine-grained access control uses IAM condition keys dynamodb:LeadingKeys and dynamodb:Attributes to restrict users to their own partitions or columns. Redshift supports IAM roles for COPY/UNLOAD, plus row-level and column-level security. Secrets Manager rotation plus IAM auth are the two ways to eliminate stored passwords.
Auditing and detection
Engine audit logs (pgaudit, the MySQL/MariaDB audit plugin) exported to CloudWatch Logs cover statement-level auditing. CloudTrail data events are needed to see DynamoDB item-level API calls, since management events cover only control-plane actions. GuardDuty RDS Protection detects anomalous login behavior; Macie classifies sensitive data in S3 exports.
Traps
You cannot toggle encryption on a live unencrypted RDS instance. Security groups versus NACLs: security groups are stateful and instance-level, NACLs are stateless and subnet-level. IAM auth is not a fit for every engine. Audit plugins must be enabled and their logs exported - the feature being available does not mean it is on.
Rule of thumb
Default to least privilege at every layer: no public endpoint, IAM auth or rotated secrets instead of static passwords, CMKs you control, and CloudTrail data events wherever item-level audit is required.