Topics

• Sign up for an AWS account

• Create a user with administrative access

• Grant programmatic access

• Determine requirements

• Provide access to your DB instance in your VPC bycreating a security group

To sign up for an AWS account

1. Openhttps://portal.aws.amazon.com/billing/signup.

2. Follow the online instructions.

   Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad.

   When you sign up for an AWS account, anAWS account root user is created. The root user has access to all AWS services and resources in the account. As a security best practice, assign administrative access to a user, and use only the root user to performtasks that require root user access.

Secure your AWS account root user

1. Sign in to theAWS Management Console as the account owner by choosingRoot user and entering your AWS account email address. On the next page, enter your password.

   For help signing in by using root user, seeSigning in as the root user in theAWS Sign-In User Guide.

2. Turn on multi-factor authentication (MFA) for your root user.

   For instructions, seeEnable a virtual MFA device for your AWS account root user (console) in theIAM User Guide.

Create a user with administrative access

1. Enable IAM Identity Center.

   For instructions, seeEnabling AWS IAM Identity Center in theAWS IAM Identity Center User Guide.

2. In IAM Identity Center, grant administrative access to a user.

   For a tutorial about using the IAM Identity Center directory as your identity source, see Configure user access with the default IAM Identity Center directory in theAWS IAM Identity Center User Guide.

Sign in as the user with administrative access

• To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email address when you created the IAM Identity Center user.

  For help signing in using an IAM Identity Center user, seeSigning in to the AWS access portal in theAWS Sign-In User Guide.

Assign access to additional users

1. In IAM Identity Center, create a permission set that follows the best practice of applying least-privilege permissions.

   For instructions, see Create a permission set in theAWS IAM Identity Center User Guide.

2. Assign users to a group, and then assign single sign-on access to the group.

   For instructions, see Add groups in theAWS IAM Identity Center User Guide.

• Resource requirements– What are the memory andprocessor requirements for your application or service? You use these settingsto help you determine what DB instance class to use. For specifications about DBinstance classes, seeDB instance classes.

• VPC, subnet, and security group –Your DB instancewill most likely be in a virtual private cloud (VPC). To connect to your DBinstance, you need to set up security group rules. These rules are set updifferently depending on what kind of VPC you use and how you use it. Forexample, you can use: a default VPC or a user-defined VPC.

  The following list describes the rules for each VPC option:

  • Default VPC – If your AWS account has adefault VPC in the current AWS Region, that VPC is configured to supportDB instances. If you specify the default VPC when you create the DBinstance, do the following:

    • Make sure to create aVPC security group that authorizesconnections from the application or service to the Amazon RDS DBinstance. Use theSecurity Group option on the VPCconsole or the AWS CLI to create VPC security groups. Forinformation, seeStep 3: Create a VPC securitygroup.

    • Specify the default DB subnet group. If this is the first DB instance you have createdin this AWS Region, Amazon RDS creates the default DB subnet groupwhen it creates the DB instance.

  • User-defined VPC –If you want to specify auser-defined VPC when you create a DB instance, be aware of thefollowing:

    • Make sure to create aVPC security group that authorizesconnections from the application or service to the Amazon RDS DBinstance. Use theSecurity Group option on the VPCconsole or the AWS CLI to create VPC security groups. For information, seeStep 3: Create a VPC securitygroup.

    • The VPC must meet certain requirements in order to host DB instances, suchas having at least two subnets, each in a separate AvailabilityZone. For information, seeAmazon VPC and Amazon RDS.

    • Make sure to specify a DB subnet group that defines which subnets in that VPC can beused by the DB instance. For information, see the DB subnetgroup section inWorking with a DB instance in a VPC.

• High availability –Do you need failoversupport? On Amazon RDS, a Multi-AZ deployment creates a primary DB instance and asecondary standby DB instance in another Availability Zone for failover support.We recommend Multi-AZ deployments for production workloads to maintain highavailability. For development and test purposes, you can use a deployment thatisn't Multi-AZ. For more information, seeConfiguring and managing a Multi-AZ deployment for Amazon RDS.

• IAM policies– Does your AWS account havepolicies that grant the permissions needed to perform Amazon RDS operations? If youare connecting to AWS using IAM credentials, your IAM account must haveIAM policies that grant the permissions required to perform Amazon RDS operations.For more information, seeIdentity and access management for Amazon RDS.

• Open ports– What TCP/IP port does your databaselisten on? The firewalls at some companies might block connections to thedefault port for your database engine. If your company firewall blocks thedefault port, choose another port for the new DB instance. When you create a DBinstance that listens on a port you specify, you can change the port bymodifying the DB instance.

• AWS Region– What AWS Region do you want yourdatabase in? Having your database in close proximity to your application or webservice can reduce network latency. For more information, seeRegions, Availability Zones, and Local Zones.

• DB disk subsystem– What are your storagerequirements? Amazon RDS provides three storage types:

  • General Purpose (SSD)

  • Provisioned IOPS (PIOPS)

  • Magnetic (also known as standard storage)

  For more information on Amazon RDS storage, seeAmazon RDS DB instance storage.

To create a VPC security group

1. Sign in to the AWS Management Console and open the Amazon VPC console athttps://console.aws.amazon.com/vpc.

   Note

   Make sure you are in the VPC console, not the RDS console.

2. In the upper-right corner of the AWS Management Console, choose the AWS Region where you want to createyour VPC security group and DB instance. In the list of Amazon VPC resources for thatAWS Region, you should see at least one VPC and several subnets. If youdon't, you don't have a default VPC in that AWS Region.

3. In the navigation pane, chooseSecurity Groups.

4. ChooseCreate security group.

   TheCreate security group page appears.

5. InBasic details, enter theSecurity group name andDescription. ForVPC, choose the VPC that youwant to create your DB instance in.

6. InInbound rules, chooseAdd rule.

   1. ForType, chooseCustom TCP.

   2. ForPort range, enter the port value to use for your DBinstance.

   3. ForSource, choose a security group name or type the IP addressrange (CIDR value) from where you access the DB instance. If you chooseMy IP, this allows access to the DB instancefrom the IP address detected in your browser.

7. If you need to add more IP addresses or different port ranges, chooseAdd rule and enter the information for the rule.

8. (Optional) InOutbound rules, add rules for outbound traffic.By default, all outbound traffic is allowed.

9. ChooseCreate security group.