> ## Documentation Index
> Fetch the complete documentation index at: https://kb.aampe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS RDS

> Estimated setup time: 1 hour

This guide provides instructions for granting Aampe access to your AWS RDS database for data synchronization.

Grant Aampe direct read access to your RDS instance for real-time data synchronization.

### Requirements

* AWS account with an existing RDS instance
* Admin access to your AWS account
* RDS instance endpoint and database name
* Network access configured (Security Groups/VPC)

### Setup Steps

#### 1. Create Database User for Aampe

Connect to your RDS instance and create a read-only user:

```
-- For MySQL/MariaDB
CREATE USER 'aampe_reader'@'%' IDENTIFIED BY 'STRONG_PASSWORD_HERE';

-- For PostgreSQL
CREATE USER aampe_reader WITH PASSWORD 'STRONG_PASSWORD_HERE';

-- For SQL Server
CREATE LOGIN aampe_reader WITH PASSWORD = 'STRONG_PASSWORD_HERE';
CREATE USER aampe_reader FOR LOGIN aampe_reader;
```

#### 2. Grant Read Permissions

```
-- For MySQL/MariaDB
GRANT SELECT ON your_database.* TO 'aampe_reader'@'%';
FLUSH PRIVILEGES;

-- For PostgreSQL
GRANT CONNECT ON DATABASE your_database TO aampe_reader;
GRANT USAGE ON SCHEMA public TO aampe_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO aampe_reader;
-- For future tables
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO aampe_reader;

-- For SQL Server
USE your_database;
ALTER ROLE db_datareader ADD MEMBER aampe_reader;
```

#### 3. Configure Network Access

Update your RDS Security Group to allow Aampe's IP addresses:

```
# Add ingress rule to your RDS security group
aws ec2 authorize-security-group-ingress \
  --group-id sg-YOUR_SECURITY_GROUP_ID \
  --protocol tcp \
  --port YOUR_DB_PORT \
  --cidr AAMPE_IP_RANGE/32 \
  --group-rule-description "Aampe data sync access"
```

**Note:** Your Aampe representative will provide the specific IP addresses or ranges to allowlist.

#### 4. Enable SSL/TLS (Recommended)

```
# Download RDS CA certificate
wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

# For MySQL, enforce SSL for the Aampe user
mysql> ALTER USER 'aampe_reader'@'%' REQUIRE SSL;
```

#### 5. Provide Information to Aampe

Share the following with your Aampe representative:

* **Endpoint:** `your-instance.region.rds.amazonaws.com`
* **Port:** (default: MySQL 3306, PostgreSQL 5432, SQL Server 1433)
* **Database name**
* **Username:** `aampe_reader`
* **Password:** (share securely)
* **SSL certificate:** (if using SSL)
* **List of tables to sync**