1. What is RDS Proxy?

Amazon RDS Proxy is a fully managed database proxy that sits between your application and your RDS/Aurora database. It pools and shares database connections, improving application scalability, resilience, and security.

Why RDS Proxy?
Opening and closing database connections is expensive. Applications with many short-lived connections (Lambda, microservices) can overwhelm the database with connection overhead. RDS Proxy pools connections and reuses them, reducing database load and improving failover speed

2. The Connection Problem

Without RDS Proxy:

Lambda Function 1 ───┐
Lambda Function 2 ───┤
Lambda Function 3 ───┤───→ RDS Database
...                  │      (100+ concurrent connections)
Lambda Function 100 ─┘      (connection exhaustion!)

With RDS Proxy:

Lambda Function 1 ───┐
Lambda Function 2 ───┤                        ┌─────┐
Lambda Function 3 ───┤──→ RDS Proxy ──────────┤ RDS │
...                  │    (pools & reuses     │ DB  │
Lambda Function 100 ─┘     connections)       └─────┘
                            (only ~10 DB connections)


3. Key Features


Connection Pooling

  1. Maintains a pool of warm, reusable database connections
  2. Applications connect to the proxy. Proxy reuses existing DB connections.
  3. Reduces database connection overhead by up to 97% (for Lambda)
  4. Prevents connection exhaustion under high concurrency


Improved Failover

  1. During Multi-AZ or Aurora failover, RDS Proxy automatically routes connections to the new primary
  2. Reduces failover time by up to 66%
  3. Applications don’t need to handle connection drops or retry logic
  4. Transparent to the application


IAM Authentication

  1. Enforce IAM authentication for database access
  2. No database credentials in application code
  3. Credentials stored securely in AWS Secrets Manager
  4. Proxy retrieves credentials from Secrets Manager automatically

4. Supported Databases

  1. Amazon RDS: MySQL, PostgreSQL, MariaDB, SQL Server
  2. Amazon Aurora: MySQL-compatible and PostgreSQL-compatible
  3. Does NOT support Oracle

5. RDS Proxy Architecture

6. RDS Proxy with Lambda

Lambda + RDS Proxy is the recommended architecture for Lambda functions that access relational databases.

  1. Lambda creates many short-lived connections (one per invocation)
  2. Without proxy: hundreds of Lambda invocations = hundreds of DB connections = connection exhaustion
  3. With proxy: hundreds of Lambda invocations share a small pool of DB connections
  4. Lambda must be in the same VPC as the proxy
  5. RDS Proxy is deployed in private subnets (never publicly accessible)
Important Warning
RDS Proxy is NEVER publicly accessible. It must be accessed from within the VPC. Lambda functions must be configured in the VPC to use RDS Proxy. This means Lambda also needs a NAT Gateway for internet access (if needed) — a common architectural consideration.

7. RDS Proxy with Read Replicas

  1. RDS Proxy supports read-only endpoints for Aurora Read Replicas
  2. Route read traffic through the proxy’s reader endpoint
  3. Connection pooling benefits apply to both read and write connections
  4. Useful for: read-heavy applications with many concurrent readers

8. RDS Proxy Pricing

  1. Charged per vCPU of the proxied database per hour
  2. No upfront costs, no minimum commitment
  3. Additional data transfer charges may apply
  4. Cost is justified by: reduced DB connection overhead, fewer DB resources needed, faster failover

9. When to Use RDS Proxy

Exam Tip
RDS Proxy questions: "Lambda + RDS = too many connections" = RDS Proxy. "Reduce failover time" = RDS Proxy (66% faster). "IAM authentication for database" = RDS Proxy + Secrets Manager. "Connection pooling" = RDS Proxy. Proxy is NEVER public (VPC only). Lambda must be in VPC to use proxy. Does NOT support Oracle. Credentials stored in Secrets Manager (not in code).