An RDS instance is a database server AWS runs for you. You choose where it lives and who may reach it.

Where it lives

A DB subnet group names the subnets the instance may use: private ones, in two zones or more (one is refused):

aws rds create-db-subnet-group --db-subnet-group-name market-db-subnets --db-subnet-group-description "Market database" --subnet-ids $PRIVATE_A $PRIVATE_B

Who may reach it

PostgreSQL listens on 5432. Its group lets in the app's group, and nothing else. Outside the default VPC, --group-names finds nothing; a filter does: APP_SG=$(aws ec2 describe-security-groups --filters Name=group-name,Values=app-sg --query "SecurityGroups[0].GroupId" --output text).

aws ec2 authorize-security-group-ingress --group-id $DB_SG --protocol tcp --port 5432 --source-group $APP_SG

The instance

aws rds create-db-instance --db-instance-identifier market-db --engine postgres --db-instance-class db.t3.micro --allocated-storage 20 --master-username market --master-user-password $DB_PASSWORD --db-name market --db-subnet-group-name market-db-subnets --vpc-security-group-ids $DB_SG --no-publicly-accessible

• --db-instance-class is its size (db.t3.micro is the smallest), --allocated-storage its disk in GiB.
• The master user and password sign in; --db-name makes a first database.
• --no-publicly-accessible: no address outside the VPC. Backups are kept for one day unless you say otherwise.

It goes creating, backing-up, then available: about five minutes.

aws rds describe-db-instances --db-instance-identifier market-db --query "DBInstances[0].[DBInstanceStatus,Endpoint.Address,Endpoint.Port]" --output text

The endpoint

The endpoint is a DNS name such as market-db.c…us-east-1.rds.amazonaws.com, on port 5432. It is how the app finds the database; the address behind it can change, the name stays. Keep it with EP=$(aws rds describe-db-instances --db-instance-identifier market-db --query "DBInstances[0].Endpoint.Address" --output text).

A mistake is undone by starting again: aws rds delete-db-instance --db-instance-identifier market-db --skip-final-snapshot, and aws rds delete-db-subnet-group --db-subnet-group-name market-db-subnets once no instance uses the group.