RDS & Database

Keep RDS private, let in only the app's security group, use Secrets Manager or IAM auth instead of hardcoded passwords, force TLS, and for cross-account use VPC peering or PrivateLink plus a security-group reference and a temporary role.

Multi-AZ is a hidden synchronous twin for automatic failover and availability, while read replicas are asynchronous copies you read from to scale read traffic.