TheArchitect

RDS Multi-AZ + Read Replica

AWS architecture template · SAA-C03: Multi-AZ RDS primary for HA, a read replica for read-scale, CloudWatch lag alarm, and enhanced monitoring role.

RDS Multi-AZ + Read Replica is a free AWS architecture template built with RDS, CloudWatch and IAM. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
RDS Monitoring…Primary DB (Mu…Read ReplicaReplica Lag Al…
RDS Multi-AZ + Read Replica architecture diagram

AWS services in this template

  • RDS×2
  • CloudWatch
  • IAM

Deployment notes

Needs input

  • Set MasterUserPassword via Secrets Manager or SSM before deploying.
  • ReadReplicaSourceDBInstanceIdentifier must match the primary DBInstanceIdentifier.
  • Deploy both instances into private subnets in the same VPC.

Generated CloudFormation — 4 resources

Logical IDResource type
RDSMonitoringRoleiamAWS::IAM::Role
PrimaryDBMultiAZrdsAWS::RDS::DBInstance
ReadReplicardsAWS::RDS::DBInstance
ReplicaLagAlarmcloudwatchAWS::CloudWatch::Alarm
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "RDSMonitoringRoleiam",
          "To": "PrimaryDBMultiAZrds",
          "Label": "monitoring role"
        },
        {
          "From": "RDSMonitoringRoleiam",
          "To": "ReadReplicards",
          "Label": "monitoring role"
        },
        {
          "From": "PrimaryDBMultiAZrds",
          "To": "ReadReplicards",
          "Label": "replication"
        }
      ]
    }
  },
  "Resources": {
    "RDSMonitoringRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-rds-monitoring-role",
        "Description": "Enhanced monitoring role for RDS — allows RDS to publish OS metrics to CloudWatch",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "monitoring.rds.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
        ]
      }
    },
    "PrimaryDBMultiAZrds": {
      "Type": "AWS::RDS::DBInstance",
      "DependsOn": [
        "RDSMonitoringRoleiam"
      ],
      "Properties": {
        "DBInstanceIdentifier": "saa-primary-db",
        "Engine": "postgres",
        "EngineVersion": "16.3",
        "DBName": "appdb",
        "DBInstanceClass": "db.t4g.medium",
        "MultiAZ": true,
        "AllocatedStorage": "100",
        "MaxAllocatedStorage": 500,
        "StorageType": "gp3",
        "MasterUsername": "appadmin",
        "StorageEncrypted": true,
        "DeletionProtection": true,
        "BackupRetentionPeriod": 7,
        "PreferredBackupWindow": "02:00-03:00",
        "PreferredMaintenanceWindow": "sun:04:00-sun:05:00",
        "MonitoringInterval": 60,
        "EnablePerformanceInsights": true
      }
    },
    "ReadReplicards": {
      "Type": "AWS::RDS::DBInstance",
      "DependsOn": [
        "RDSMonitoringRoleiam"
      ],
      "Properties": {
        "DBInstanceIdentifier": "saa-replica-db",
        "DBInstanceClass": "db.t4g.medium",
        "AutoMinorVersionUpgrade": true,
        "StorageType": "gp3",
        "StorageEncrypted": true,
        "MonitoringInterval": 60,
        "EnablePerformanceInsights": true,
        "SourceDBInstanceIdentifier": "saa-primary-db"
      }
    },
    "ReplicaLagAlarmcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-rds-replica-lag",
        "AlarmDescription": "Alert when replica lag exceeds 30 seconds — indicates the replica is falling behind",
        "Namespace": "AWS/RDS",
        "MetricName": "ReplicaLag",
        "Statistic": "Average",
        "Period": 60,
        "EvaluationPeriods": 5,
        "Threshold": 30,
        "ComparisonOperator": "GreaterThanOrEqualToThreshold",
        "TreatMissingData": "notBreaching"
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates