AWS Lambda's Integration with Amazon RDS
Instruction: Discuss how AWS Lambda can interact with Amazon RDS and the considerations for doing so.
Updated
Official answer
Use a database driver to issue parameterized SQL from Lambda, either directly to RDS or through a compatible RDS Proxy. For a private database, configure VPC subnets, routing and security groups so the function can reach the database/proxy port. Network reachability alone does not provide database authorization or transport security.
Use TLS with server-certificate verification. Keep credentials in Secrets Manager, or use supported IAM database authentication with the necessary configuration and database user grants. IAM permissions to call AWS APIs do not automatically authorize SQL operations. Grant the database identity only the required tables and actions.
RDS Proxy can pool database connections and absorb connection churn, but it cannot remove the database's CPU, locking or transaction limits. Check engine/version support, connection pinning and proxy metrics. Reuse healthy clients where appropriate, bound connection and query timeouts, and ensure failed transactions are rolled back before reuse.
Cap Lambda concurrency to a measured database budget and leave capacity for other clients. Use short transactions, indexed queries and idempotency for retried writes. Test failover and ambiguous commit outcomes. RDS instances and proxies can incur costs while idle; the combined system does not automatically have Lambda's per-invocation cost behavior.