Amazon Aurora
User Guide for Aurora (API Version 2014-10-31)

Internetwork Traffic Privacy

Connections are protected both between Amazon Aurora and on-premises applications and between Amazon Aurora and other AWS resources within the same AWS Region.

Traffic Between Service and On-Premises Clients and Applications

You have two connectivity options between your private network and AWS:

Access to Amazon Aurora via the network is through AWS published APIs. Clients must support Transport Layer Security (TLS) 1.0. We recommend TLS 1.2. Clients must also support cipher suites with Perfect Forward Secrecy (PFS), such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). Most modern systems such as Java 7 and later support these modes. Additionally, you must sign requests using an access key ID and a secret access key that are associated with an IAM principal. Or you can use the AWS Security Token Service (STS) to generate temporary security credentials to sign requests.

Traffic Between AWS Resources in the Same Region

An Amazon Virtual Private Cloud (Amazon VPC) endpoint for Amazon Aurora is a logical entity within a VPC that allows connectivity only to Amazon Aurora. The Amazon VPC routes requests to Amazon Aurora and routes responses back to the VPC. For more information, see VPC Endpoints in the Amazon VPC User Guide. For example bucket policies that you can use to control DB cluster access from VPC endpoints, see Creating and Using an IAM Policy for IAM Database Access.