Aurora Storage Architecture
The aurora storage architecture separates your database compute nodes from a shared storage layer. You set it up by creating a cluster that writes redo logs across zones. Most teams start by setting up one writer node and several reader nodes. Then they grant broad cloud roles or shared database logins to developers. When roles are too broad, anyone with a login can change or read data. A single bad query or mistake can expose sensitive rows across the whole cluster. How the aurora storage arc
Zero Trust Architecture: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
The aurora storage architecture separates your database compute nodes from a shared storage layer. You set it up by creating a cluster that writes redo logs across zones. Most teams start by setting up one writer node and several reader nodes. Then they grant broad cloud roles or shared database logins to developers. When roles are too broad, anyone with a login can change or read data. A single bad query or mistake can expose sensitive rows across the whole cluster.
How the aurora storage architecture works in practice
In a standard database, the compute node writes full data pages to its disk. This creates heavy network traffic and slows down write bursts. The aurora storage architecture changes this workflow at the base layer. The primary compute node only sends small redo log records to the storage layer. It does not send full data pages over the network. The shared storage layer takes those log records and builds data blocks on demand. It spreads copies of your data across three separate cloud zones for safety. Reader nodes read from that same shared disk volume without copying all the data. When you add a new reader node, it attaches to the existing volume fast. The primary node and all reader nodes see the same underlying storage layer. You manage access to these nodes through cluster endpoints and database user roles. Cloud roles can also let users log in without static passwords. Each endpoint routes traffic to the primary writer or to the pool of readers.
Why shared storage needs tighter query controls
Separating compute from storage solves big problems with disk scaling and failover times. If a compute node fails, a reader node takes over in a short time. The disk volume stays intact across zones even if one zone goes down. Still, this design leaves a big gap in day-to-day data security. Cloud roles and cluster endpoints only decide who can log in to a node. They do not check what individual queries do after a session starts. A developer connected to a reader endpoint can still pull full customer tables. That output might include emails, phone numbers, card numbers, or national IDs. Meanwhile, an engineer on the writer endpoint can run an unapproved delete statement. Native database logs record the crime after it happens, which is too late. Static grants inside the database are hard to keep updated across many teams. Over time, temporary permissions turn into permanent access for humans and scripts alike.
Managing human and script access to cluster nodes
Teams often try to fix this gap by creating dozens of custom database roles. They make separate roles for junior engineers, senior staff, and automated background apps. Keeping those grants in sync across PostgreSQL or MySQL engines takes constant manual work. When an incident happens, on-call staff still need fast write access to fix issues. Giving them full admin credentials puts every table in the shared volume at risk. A better path is to check every command in flight and rewrite sensitive fields. Data masking rewrites matched fields like emails or card numbers in query results. You also want individual approval steps before a risky write statement runs on data.
Zero Trust Architecture: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
How does the storage layer handle writes without blocking down?
The primary node sends only small redo log records to the storage volume. The storage layer groups those logs and builds data pages in the background.
Do reader nodes keep their own copy of the database disk?
No, all reader nodes attach to the same shared storage volume as the writer. This lets you add or remove readers without copying terabytes of data.
Can a reader endpoint stop users from seeing sensitive data?
No, a reader endpoint only stops write commands from running on the database. Users with select access can still read raw emails, phone numbers, and card numbers.