Amazon Aurora

# Change the Serverless v2 range (also turns scale-to-zero on or off)
aws rds modify-db-cluster --db-cluster-identifier bookshelf-catalog \
  --serverless-v2-scaling-configuration MinCapacity=0.5,MaxCapacity=16 --apply-immediately

# Dev cluster: scale to zero after 10 minutes idle
aws rds modify-db-cluster --db-cluster-identifier bookshelf-catalog-dev \
  --serverless-v2-scaling-configuration MinCapacity=0,MaxCapacity=4,SecondsUntilAutoPause=600

# Add an independent, pausable reporting reader (promotion tier 2-15)
aws rds create-db-instance --db-instance-identifier bookshelf-catalog-reports \
  --db-cluster-identifier bookshelf-catalog --engine aurora-postgresql \
  --db-instance-class db.serverless --promotion-tier 5

# Custom endpoint that exposes only the reporting reader
aws rds create-db-cluster-endpoint --db-cluster-identifier bookshelf-catalog \
  --db-cluster-endpoint-identifier reports --endpoint-type READER \
  --static-members bookshelf-catalog-reports

# Test failover: the tier-1 reader is promoted, the cluster endpoint follows
aws rds failover-db-cluster --db-cluster-identifier bookshelf-catalog

# Watch what the capacity actually did
aws cloudwatch get-metric-statistics --namespace AWS/RDS --metric-name ServerlessDatabaseCapacity \
  --dimensions Name=DBInstanceIdentifier,Value=bookshelf-catalog-1 \
  --start-time "$(date -u -v-1H +%FT%TZ)" --end-time "$(date -u +%FT%TZ)" \
  --period 300 --statistics Minimum Maximum Average

CLUSTER_ARN=arn:aws:rds:us-east-1:111122223333:cluster:bookshelf-catalog

aws rds enable-http-endpoint --resource-arn "$CLUSTER_ARN"       # or --enable-http-endpoint at create time

aws rds-data execute-statement \
  --resource-arn "$CLUSTER_ARN" \
  --secret-arn "$SECRET_ARN" \
  --database catalog \
  --sql "SELECT isbn, title FROM books WHERE title ILIKE :q LIMIT 5" \
  --parameters '[{"name":"q","value":{"stringValue":"%sql%"}}]' \
  --format-records-as JSON

import software.amazon.awssdk.services.rdsdata.RdsDataClient;
import software.amazon.awssdk.services.rdsdata.model.*;

try (RdsDataClient data = RdsDataClient.create()) {   // default credential chain: task or execution role
    ExecuteStatementResponse r = data.executeStatement(ExecuteStatementRequest.builder()
            .resourceArn(System.getenv("CLUSTER_ARN"))
            .secretArn(System.getenv("SECRET_ARN"))
            .database("catalog")
            .sql("SELECT isbn, title FROM books WHERE id = :id")
            .parameters(SqlParameter.builder().name("id")
                    .value(Field.builder().longValue(42L).build()).build())
            .build());
    r.records().forEach(row -> System.out.println(row.get(1).stringValue()));
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ManageBookshelfAuroraClusters",
      "Effect": "Allow",
      "Action": [
        "rds:CreateDBCluster", "rds:ModifyDBCluster", "rds:DeleteDBCluster",
        "rds:CreateDBInstance", "rds:ModifyDBInstance", "rds:DeleteDBInstance",
        "rds:FailoverDBCluster", "rds:RebootDBInstance",
        "rds:CreateDBClusterSnapshot", "rds:RestoreDBClusterToPointInTime",
        "rds:BacktrackDBCluster", "rds:AddTagsToResource"
      ],
      "Resource": [
        "arn:aws:rds:us-east-1:111122223333:cluster:bookshelf-*",
        "arn:aws:rds:us-east-1:111122223333:db:bookshelf-*",
        "arn:aws:rds:us-east-1:111122223333:cluster-snapshot:bookshelf-*",
        "arn:aws:rds:us-east-1:111122223333:subgrp:bookshelf-db-subnets",
        "arn:aws:rds:us-east-1:111122223333:pg:default.*",
        "arn:aws:rds:us-east-1:111122223333:cluster-pg:default.*"
      ]
    },
    {
      "Sid": "DescribeAndSubnetGroups",
      "Effect": "Allow",
      "Action": ["rds:Describe*", "rds:ListTagsForResource", "rds:CreateDBSubnetGroup"],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "ConnectAsCatalogApp",
    "Effect": "Allow",
    "Action": "rds-db:connect",
    "Resource": "arn:aws:rds-db:us-east-1:111122223333:dbuser:cluster-ABCDEFGHIJKLMNOPQRSTUVWXYZ/catalog_app"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RunSqlThroughDataApi",
      "Effect": "Allow",
      "Action": [
        "rds-data:ExecuteStatement", "rds-data:BatchExecuteStatement",
        "rds-data:BeginTransaction", "rds-data:CommitTransaction", "rds-data:RollbackTransaction"
      ],
      "Resource": "arn:aws:rds:us-east-1:111122223333:cluster:bookshelf-catalog"
    },
    {
      "Sid": "ReadTheClusterSecret",
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:us-east-1:111122223333:secret:rds!cluster-*"
    }
  ]
}

TOKEN=$(aws rds generate-db-auth-token --hostname "$WRITER" --port 5432 \
  --region us-east-1 --username catalog_app)
PGPASSWORD="$TOKEN" psql "host=$WRITER port=5432 dbname=catalog user=catalog_app sslmode=verify-full sslrootcert=global-bundle.pem" -c 'select current_user'

# Clone production into a throwaway test cluster (same VPC, same subnet group)
aws rds restore-db-cluster-to-point-in-time \
  --source-db-cluster-identifier bookshelf-catalog \
  --db-cluster-identifier bookshelf-catalog-clone \
  --restore-type copy-on-write --use-latest-restorable-time \
  --db-subnet-group-name bookshelf-db-subnets --vpc-security-group-ids "$DB_SG" \
  --serverless-v2-scaling-configuration MinCapacity=0,MaxCapacity=4,SecondsUntilAutoPause=600
aws rds create-db-instance --db-instance-identifier bookshelf-catalog-clone-1 \
  --db-cluster-identifier bookshelf-catalog-clone --engine aurora-postgresql --db-instance-class db.serverless

# Point-in-time restore to a full copy at a past time
aws rds restore-db-cluster-to-point-in-time \
  --source-db-cluster-identifier bookshelf-catalog --db-cluster-identifier bookshelf-catalog-restored \
  --restore-type full-copy --restore-to-time 2026-09-30T10:15:00Z \
  --db-subnet-group-name bookshelf-db-subnets --vpc-security-group-ids "$DB_SG"

# Manual snapshot, and a cross-Region copy for disaster recovery
aws rds create-db-cluster-snapshot --db-cluster-identifier bookshelf-catalog \
  --db-cluster-snapshot-identifier bookshelf-catalog-pre-migration

aws rds create-db-cluster --db-cluster-identifier bookshelf-orders-mysql --engine aurora-mysql \
  --master-username admin --manage-master-user-password --backtrack-window 86400 \
  --db-subnet-group-name bookshelf-db-subnets --vpc-security-group-ids "$DB_SG"

aws rds backtrack-db-cluster --db-cluster-identifier bookshelf-orders-mysql \
  --backtrack-to 2026-09-30T10:15:00Z

# Aurora clusters: instances first, then the cluster
aws rds modify-db-cluster --db-cluster-identifier bookshelf-catalog --no-deletion-protection --apply-immediately
for I in bookshelf-catalog-reports bookshelf-catalog-2 bookshelf-catalog-1; do
  aws rds delete-db-instance --db-instance-identifier "$I"
done
aws rds delete-db-cluster --db-cluster-identifier bookshelf-catalog --skip-final-snapshot   # or --final-db-snapshot-identifier

# Clone, restored cluster and the custom endpoint
aws rds delete-db-cluster-endpoint --db-cluster-endpoint-identifier reports      # before deleting its cluster
aws rds delete-db-instance --db-instance-identifier bookshelf-catalog-clone-1
aws rds delete-db-cluster --db-cluster-identifier bookshelf-catalog-clone --skip-final-snapshot

# Global Database: remove the secondary, then the global cluster
aws rds remove-from-global-cluster --global-cluster-identifier bookshelf-global \
  --db-cluster-identifier arn:aws:rds:us-west-2:111122223333:cluster:bookshelf-catalog-usw2 --region us-east-1
aws rds delete-global-cluster --global-cluster-identifier bookshelf-global

# Manual snapshots, subnet group and security group
aws rds delete-db-cluster-snapshot --db-cluster-snapshot-identifier bookshelf-catalog-pre-migration
aws rds delete-db-subnet-group --db-subnet-group-name bookshelf-db-subnets
aws ec2 delete-security-group --group-id "$DB_SG"

# Aurora DSQL: turn off deletion protection, then delete
aws dsql update-cluster --region us-east-1 --identifier "$CLUSTER_ID" --no-deletion-protection-enabled
aws dsql delete-cluster --region us-east-1 --identifier "$CLUSTER_ID"