DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a single RDS instance with a separate database per microservice.

  Why it's wrong here

  While creating separate databases within a single RDS instance offers logical separation, database-level privileges are typically granted to users. This approach does not inherently provide fine-grained, table-level access control, which is crucial for microservices to adhere to the principle of least privilege and prevent one service from accessing another's specific data tables without authorization. It's a step towards isolation but lacks the granularity needed for robust microservice security.

• ✓

  Use RDS with IAM database authentication and create database users with limited privileges for each microservice.

  Why this is correct

  AWS IAM database authentication integrates directly with IAM, allowing microservices to authenticate using IAM roles or users, eliminating the need for hardcoded database credentials. This method enables the creation of highly granular database users with specific permissions (e.g., SELECT on tableA, INSERT on tableB), ensuring each microservice can only access the precise tables and operations it requires. This robust, fine-grained access control is essential for securing a microservices architecture.

• ✗

  Use RDS in a VPC and restrict network access per microservice using security groups.

  Why it's wrong here

  While placing RDS in a VPC and using security groups is a fundamental best practice for network isolation, security groups operate at the network layer (Layer 4). They control inbound and outbound traffic based on IP addresses and ports, effectively restricting which microservices can connect to the database instance. However, security groups offer no mechanism to differentiate or restrict access to specific databases, schemas, or tables within the connected database, failing to provide the necessary data-level access control for microservices.

• ✗

  Use Amazon RDS Proxy to control access.

  Why it's wrong here

  Amazon RDS Proxy primarily focuses on connection management, pooling, and failover handling to improve application resilience and scalability. While it can integrate with AWS Secrets Manager for credential management and enforce some authentication policies, its core design is not for fine-grained, table-level authorization within the database itself. It acts as a proxy for connections, not as an authorization layer for specific database objects, thus not addressing the requirement for limited privileges per microservice at the data level.