rds-operation-review

Files (8)

• CHANGELOG.md
• README.md
• SKILL.md
• eval_queries.json · evals/
• evals.json · evals/
• database-context.json · evals/files/
• best-practices-checklist.md · references/
• metrics-thresholds.md · references/

SKILL.md (first lines)

# RDS / Aurora Operational Review

Conduct a comprehensive operational review of Amazon RDS instances and Amazon Aurora
clusters aligned with the [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html)
and the [Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html)
and [Aurora](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_BestPractices.html)
best-practices guides.

This skill uses the **AWS RDS, Aurora, CloudWatch, CloudWatch Logs, EC2, and Cost
Explorer APIs only** — no Kubernetes (`k8s`) or `eks` MCP tools. All data is
collected through native AWS APIs available to the DevOps Agent's primary cloud
source role.

## When to Use

Activate this skill when the user asks to:
- Review, audit, or assess RDS instances or Aurora clusters
- Check RDS / Aurora best-practices compliance
- Evaluate database security, cost, reliability, performance, or backups
- Perform an RDS / Aurora operational readiness review (ORR)
- Investigate database health or configuration drift

## Step 1: Identify Target Resources

Ask the user which databases to review. Accept:
- Specific instance / cluster identifiers and regions
- "all instances" / "all clusters" in specific regions
- "all RDS in all regions"

If no scope is given, default to all configured account regions.

## Step 2: Discover RDS / Aurora Resources

Per region (skip empty regions):

```
rds.DescribeDBInstances           # RDS instances + Aurora cluster member instances
rds.DescribeDBClusters            # Aurora clusters (skip if user said "Provisioned only")
rds.DescribeDBClusterEndpoints    # Aurora reader/writer endpoints
rds.DescribeGlobalClusters        # Aurora Global Database (cross-region)
rds.DescribeDBProxies             # RDS Proxy
```

Capture per resource:
- Engine, engineVersion, dbInstanceClass / serverlessV2 capacity
- Multi-AZ, AvailabilityZones, subnetGroup, VpcId
- AllocatedStorage, MaxAllocatedStorage, StorageType, Iops, StorageThroughput, StorageEncrypted, KmsKeyId
- BackupRetentionPeriod, PreferredBackupWindow, PreferredMaintenanceWindow, AutoMinorVersionUpgrade
- DeletionProtection, PubliclyAccessible, IAMDatabaseAuthenticationEnabled
- PerformanceInsightsEnabled, PerformanceInsightsRetentionPeriod, MonitoringInterval (Enhanced Monitoring), MonitoringRoleArn
- EnabledCloudwatchLogsExports, AssociatedRoles
- ReadReplicaSourceDBInstanceIdentifier / ReadReplicaDBInstanceIdentifiers
- Tags (`rds.ListTagsForResource` — param name is `ResourceName` and value is the resource ARN)

## Step 3: Discover Configuration Dependencies

For each database, collect:

```
rds.DescribeDBParameterGroups           # custom vs default
rds.DescribeDBClusterParameterGroups    # Aurora
rds.DescribeOptionGroups                # RDS option groups
rds.DescribeDBSubnetGroups              # subnet AZ spread
ec2.DescribeSecurityGroups              # vpcSecurityGroupIds → ingress rules
kms.DescribeKey                         # for KmsKeyId (encryption at rest)
```

## Step 4: Collect Backups, Snapshots, Maintenance

```
rds.DescribeDBSnapshots                            # manual + automated, per instance
rds.DescribeDBClusterSnapshots                     # Aurora
rds.DescribeDBInstanceAutomatedBackups
rds.DescribeDBClusterAutomatedBackups
rds.DescribeDBEngineVersions                       # current vs latest minor/major
rds.DescribePendingMaintenanceActions
rds.DescribeEvents                                 # last 14 days; duration in MINUTES (20160)
rds.DescribeEventSubscriptions
```

For each instance/cluster, also fetch:
- `rds.DescribeDBLogFiles` — list of logs available locally on the DB
- `logs.DescribeLogGroups` with prefix:
  - Instances: `/aws/rds/instance/<dbInstanceIdentifier>/`
  - Aurora: `/aws/rds/cluster/<dbClusterIdentifier>/`

## Step 5: Collect CloudWatch Metrics (7-Day Historical)

**One** `cloudwatch.GetMetricData` call per resource. `Period: 21600` (6 hours).
`StartTime`: 7 days ago. `EndTime`: now.

### 5.1 RDS Instances (dimension `DBInstanceIdentifier`)

| id | metricName | stat | unit |
|----|------------|------|------|
| `cpu` | CPUUtilization | Average | % |
| `freeMem` | FreeableMemory | Minimum | bytes |
| `freeSpace` | FreeStorageSpace | Minimum | bytes |
| `readIops` | ReadIOPS | Average | count/s |
| `writeIops` | WriteIOPS | Average | count/s |
| `readLat` | ReadLatency | Average | s |
| `writeLat` | WriteLatency | Average | s |
| `dbConn` | DatabaseConnections | Maximum | count |
| `swap` | SwapUsage | Average | bytes |
| `netIn` | NetworkReceiveThroughput | Average | bytes/s |
| `netOut` | NetworkTransmitThroughput | Average | bytes/s |
| `binLog` | BinLogDiskUsage | Average | bytes |
| `replLag` | ReplicaLag | Maximum | s |

### 5.2 Aurora Clusters (dimension `DBClusterIdentifier`)

| id | metricName | stat | unit |
|----|------------|------|------|
| `cpu` | CPUUtilization | Average | % |
| `freeMem` | FreeableMemory | Minimum | bytes |
| `dbConn` | DatabaseConnections | Maximum | count |
| `replLag` | AuroraReplicaLag | Maximum | ms |
| `bufCache` | BufferCacheHitRatio | Average | % |
| `commitLat` | CommitLatency | Average | ms |

From aws/tools-for-devops-agent, Apache-2.0.

More from aws/tools-for-devops-agent