# Exercise 1: Launch a Production-Ready PostgreSQL on RDS

```
STEP 1. Create a DB subnet group spanning two PRIVATE subnets in different AZs.
STEP 2. Create a security group for the database that allows 5432 ONLY from the
        application tier's security group (not from a CIDR).
STEP 3. Write the create-db-instance command: PostgreSQL 16, Multi-AZ, encrypted
        storage, gp3, automated backups kept 14 days, deletion protection,
        not publicly accessible, master password managed by Secrets Manager,
        a custom parameter group, Performance Insights on.
STEP 4. Add a read replica in the same region for reporting queries.
STEP 5. Explain (as comments) which of Multi-AZ and the read replica protects
        against an AZ outage, which helps read throughput, and why.
```

This is a config-only exercise (CLI) — verify yourself against the **Requirements Checklist** at the bottom.

## Subnet group (TODO)

```bash
aws rds create-db-subnet-group \
  --db-subnet-group-name TODO \
  --db-subnet-group-description "private subnets for orders db" \
  --subnet-ids TODO-private-subnet-az-a TODO-private-subnet-az-b
```

## Security group rule (TODO)

```bash
aws ec2 authorize-security-group-ingress \
  --group-id TODO-db-sg \
  --protocol tcp --port 5432 \
  --TODO-the-flag-that-references-another-security-group TODO-app-sg
```

## Database (TODO)

```bash
aws rds create-db-instance \
  --db-instance-identifier orders-db \
  --engine postgres --engine-version TODO \
  --db-instance-class db.m6g.large \
  --allocated-storage 100 --storage-type TODO \
  --TODO-multi-az-flag \
  --TODO-encryption-flag \
  --backup-retention-period TODO \
  --TODO-deletion-protection-flag \
  --TODO-not-publicly-accessible-flag \
  --master-username orders_admin \
  --TODO-flag-for-secrets-manager-managed-password \
  --db-subnet-group-name TODO \
  --vpc-security-group-ids TODO \
  --db-parameter-group-name TODO \
  --enable-performance-insights
```

## Read replica (TODO)

```bash
aws rds create-db-instance-read-replica \
  --db-instance-identifier TODO \
  --source-db-instance-identifier TODO
```

## STEP 5 answers (TODO)

```
# Multi-AZ:
# Read replica:
```

## Requirements Checklist

- [ ] The subnet group contains only private subnets (route tables without `0.0.0.0/0 → igw-…`) in **two different AZs** (theory §6).
- [ ] The DB security group's ingress uses `--source-group <app-sg>`, not a CIDR (`09-security_groups`).
- [ ] `--multi-az`, `--storage-encrypted`, `--storage-type gp3`, `--backup-retention-period 14`, `--deletion-protection`, `--no-publicly-accessible`, `--manage-master-user-password` are all present.
- [ ] A custom parameter group is referenced (defaults can't be edited — theory §7).
- [ ] The answers state: Multi-AZ = synchronous standby for **availability** (automatic failover, not readable for traffic in classic Multi-AZ); read replica = asynchronous copy for **read scaling** (lag, manual promotion) — theory §4.