RDS and Aurora hold relational data behind two separable surfaces. The control plane lets a principal with RDS permissions copy or share a snapshot, restore it into an instance they own, and read the whole database offline without ever touching the original. The data plane is the running instance, reachable when its endpoint is public, its security group is loose, or its credentials are weak or recoverable.
What folds in here#
- Snapshots: sharing, copying, and restoring snapshots to read the database offline.
- Access: reaching live instances through exposed endpoints, weak credentials, or RDS IAM authentication.