View a markdown version of this page

Creating an Amazon Aurora DB cluster - Amazon Aurora
PrerequisitesCreating a DB clusterAvailable settingsSettings that don't apply to Aurora for DB clustersSettings that don't apply to Aurora DB instances

Creating an Amazon Aurora DB cluster

An Amazon Aurora DB cluster consists of a DB instance, compatible with either MySQL or PostgreSQL, and a cluster volume that holds the data for the DB cluster, copied across three Availability Zones as a single, virtual volume. By default, an Aurora DB cluster contains a primary DB instance that performs reads and writes, and, optionally, up to 15 Aurora Replicas (reader DB instances). For more information about Aurora DB clusters, see Amazon Aurora DB clusters.

Aurora has two main types of DB cluster:

  • Aurora provisioned – You choose the DB instance class for the writer and reader instances based on your expected workload. For more information, see Amazon AuroraDB instance classes. Aurora provisioned has several options, including Aurora global databases. For more information, see Using Amazon Aurora Global Database.

  • Aurora Serverless – Aurora serverless is an on-demand automatic scaling configuration for Aurora. Capacity is adjusted automatically based on application demand. You're charged only for the resources that your DB cluster consumes. This automation is especially useful for environments with highly variable and unpredictable workloads. For more information, see Using Aurora serverless.

Following, you can find out how to create an Aurora DB cluster. To get started, first see DB cluster prerequisites.

For instructions on connecting to your Aurora DB cluster, see Connecting to an Amazon Aurora DB cluster.

DB cluster prerequisites

Important

Before you can create an Aurora DB cluster, you must complete the tasks in Setting up your environment for Amazon Aurora.

The following are prerequisites to complete before creating a DB cluster.

Configure the network for the DB cluster

You can create an Amazon Aurora DB cluster only in a virtual private cloud (VPC) based on the Amazon VPC service, in an AWS Region that has at least two Availability Zones. The DB subnet group that you choose for the DB cluster must cover at least two Availability Zones. This configuration ensures that your DB cluster always has at least one DB instance available for failover, in the unlikely event of an Availability Zone failure.

If you plan to set up connectivity between your new DB cluster and an EC2 instance in the same VPC, you can do so during DB cluster creation. If you plan to connect to your DB cluster from resources other than EC2 instances in the same VPC, you can configure the network connections manually.

Configure automatic network connectivity with an EC2 instance

When you create an Aurora DB cluster, you can use the AWS Management Console to set up connectivity between an Amazon EC2 instance and the new DB cluster. When you do so, RDS configures your VPC and network settings automatically. The DB cluster is created in the same VPC as the EC2 instance so that the EC2 instance can access the DB cluster.

The following are requirements for connecting an EC2 instance with the DB cluster:

  • The EC2 instance must exist in the AWS Region before you create the DB cluster.

    If no EC2 instances exist in the AWS Region, the console provides a link to create one.

  • Currently, the DB cluster can't be an Aurora Serverless DB cluster or part of an Aurora global database.

  • The user who is creating the DB instance must have permissions to perform the following operations:

    • ec2:AssociateRouteTable

    • ec2:AuthorizeSecurityGroupEgress

    • ec2:AuthorizeSecurityGroupIngress

    • ec2:CreateRouteTable

    • ec2:CreateSubnet

    • ec2:CreateSecurityGroup

    • ec2:DescribeInstances

    • ec2:DescribeNetworkInterfaces

    • ec2:DescribeRouteTables

    • ec2:DescribeSecurityGroups

    • ec2:DescribeSubnets

    • ec2:ModifyNetworkInterfaceAttribute

    • ec2:RevokeSecurityGroupEgress

Using this option creates a private DB cluster. The DB cluster uses a DB subnet group with only private subnets to restrict access to resources within the VPC.

To connect an EC2 instance to the DB cluster, choose Connect to an EC2 compute resource in the Connectivity section on the Create database page.

Connect an EC2 instance.

When you choose Connect to an EC2 compute resource, RDS sets the following options automatically. You can't change these settings unless you choose not to set up connectivity with an EC2 instance by choosing Don't connect to an EC2 compute resource.

Console option Automatic setting

Network type

RDS sets network type to IPv4. Currently, dual-stack mode isn't supported when you set up a connection between an EC2 instance and the DB cluster.

Virtual Private Cloud (VPC)

RDS sets the VPC to the one associated with the EC2 instance.

DB subnet group

 RDS requires a DB subnet group with a private subnet in the same Availability Zone as the EC2 instance. If a DB subnet group that meets this requirement exists, then RDS uses the existing DB subnet group. By default, this option is set to Automatic setup.

When you choose Automatic setup and there is no DB subnet group that meets this requirement, the following action happens. RDS uses three available private subnets in three Availability Zones where one of the Availability Zones is the same as the EC2 instance. If a private subnet isn’t available in an Availability Zone, RDS creates a private subnet in the Availability Zone. Then RDS creates the DB subnet group.

When a private subnet is available, RDS uses the route table associated with the subnet and adds any subnets it creates to this route table. When no private subnet is available, RDS creates a route table without internet gateway access and adds the subnets it creates to the route table.

RDS also allows you to use existing DB subnet groups. Select Choose existing if you want to use an existing DB subnet group of your choice.

Public access

RDS chooses No so that the DB cluster isn't publicly accessible.

For security, it is a best practice to keep the database private and make sure it isn't accessible from the internet.

VPC security group (firewall)

RDS creates a new security group that is associated with the DB cluster. The security group is named rds-ec2-n, where n is a number. This security group includes an inbound rule with the EC2 VPC security group (firewall) as the source. This security group that is associated with the DB cluster allows the EC2 instance to access the DB cluster.

RDS also creates a new security group that is associated with the EC2 instance. The security group is named ec2-rds-n, where n is a number. This security group includes an outbound rule with the VPC security group of the DB cluster as the source. This security group allows the EC2 instance to send traffic to the DB cluster.

You can add another new security group by choosing Create new and typing the name of the new security group.

You can add existing security groups by choosing Choose existing and selecting security groups to add.

Availability Zone

When you don't create an Aurora Replica in Availability & durability during DB cluster creation (Single-AZ deployment), RDS chooses the Availability Zone of the EC2 instance.

When you create an Aurora Replica during DB cluster creation (Multi-AZ deployment), RDS chooses the Availability Zone of the EC2 instance for one DB instance in the DB cluster. RDS randomly chooses a different Availability Zone for the other DB instance in the DB cluster. Either the primary DB instance or the Aurora Replica is created in the same Availability Zone as the EC2 instance. There is the possibility of cross Availability Zone costs if the primary DB instance and EC2 instance are in different Availability Zones.

For more information about these settings, see Settings for Aurora DB clusters.

If you make any changes to these settings after the DB cluster is created, the changes might affect the connection between the EC2 instance and the DB cluster.

Configure the network manually

If you plan to connect to your DB cluster from resources other than EC2 instances in the same VPC, you can configure the network connections manually. If you use the AWS Management Console to create your DB cluster, you can have Amazon RDS automatically create a VPC for you. Or you can use an existing VPC or create a new VPC for your Aurora DB cluster. Whichever approach you take, your VPC must have at least one subnet in each of at least two Availability Zones for you to use it with an Amazon Aurora DB cluster.

By default, Amazon RDS creates the primary DB instance and the Aurora Replica in the Availability Zones automatically for you. To choose a specific Availability Zone, you need to change the Availability & durability Multi-AZ deployment setting to Don't create an Aurora Replica. Doing so exposes an Availability Zone setting that lets you choose from among the Availability Zones in your VPC. However, we strongly recommend that you keep the default setting and let Amazon RDS create a Multi-AZ deployment and choose Availability Zones for you. By doing so, your Aurora DB cluster is created with the fast failover and high availability features that are two of Aurora's key benefits.

If you don't have a default VPC or you haven't created a VPC, you can have Amazon RDS automatically create a VPC for you when you create a DB cluster using the console. Otherwise, you must do the following:

For information on VPCs, see Amazon VPC and Amazon Aurora. For a tutorial that configures the network for a private DB cluster, see Tutorial: Create a VPC for use with a DB cluster (IPv4 only).

If you want to connect to a resource that isn't in the same VPC as the Aurora DB cluster, see the appropriate scenarios in Scenarios for accessing a DB cluster in a VPC.

Additional prerequisites

Before you create your DB cluster, consider the following additional prerequisites:

  • If you are connecting to AWS using AWS Identity and Access Management (IAM) credentials, your AWS account must have IAM policies that grant the permissions required to perform Amazon RDS operations. For more information, see Identity and access management for Amazon Aurora.

    If you are using IAM to access the Amazon RDS console, you must first sign on to the AWS Management Console with your user credentials. Then go to the Amazon RDS console at