Search code examples
amazon-web-servicesamazon-aurora

Aurora is allowing writes to read only endpoint


I recently set up an Aurora RDS database and the default Writer roles shows two endpoints:

1) Writer 2) Reader

However when I access with the Reader endpoint I am still able to update records on the database.

Can someone explain why this is behaving this way?


Solution

  • This is the expected behavior in an Aurora cluster with only one instance.

    An Aurora cluster is a set of one or more instances, all accessing the same data, stored on the Aurora Cluster Volume. One of the instances is the "writer" (can modify data) and if there is more than one, then any additional instances are "readers" (can't modify data).

    The cluster endpoint DNS entries are automatically managed so that they always point to the correct instance(s).

    A single-master Aurora cluster's endpoints -- for compatibility -- work the same from the application's perspective, whether you have 1 instance or multiple instance -- there is the writer endpoint that the application can use where it needs writes, and the read-only endpoint that the application can use in cases where the application knows it does not need to write.

    With only one instance in a cluster, the RO endpoint points to the writer so that an application designed to do read/write splitting can still work without modification. If this endpoint didn't provide a usable destination in a single-instance cluster, scaling an Aurora-backed application in or out at the database layer would require application changes, but as implemented, this isn't needed... but at the same time, the "endpoints" are fundamentally just logical endpoints -- DNS entries. The instance accepting the connection has no knowledge of how the connection arrived.

    When there is more than one instance, connections to the RO endpoint are balanced among the readers using short-TTL DNS.