Database Technology

Aurora DSQL now supports partial indexes, allowing you to index only rows that meet specific criteria defined in a WHERE clause. This approach keeps index structures small by excluding large volumes of historical or non-qualifying data, reducing storage costs and improving query performance for active working sets. The system automatically utilizes these indexes when queries match the defined conditions.

• Index only active subsets (e.g., open orders) to skip scanning completed history.
• Reduces index storage overhead as the underlying table grows in size.
• Improves read performance for queries targeting the specific indexed condition.
• Aurora DSQL automatically applies the partial index when filters align.
• Available in all regions where Aurora DSQL is currently offered.

Aurora PostgreSQL supports direct querying of data lakes in Apache Iceberg and Parquet formats via foreign tables. This capability allows applications to join operational data with lakehouse storage in S3 or AWS Glue without ETL pipelines. The feature eliminates the need for data duplication and reduces engineering overhead associated with schema evolution.

• Create PostgreSQL foreign tables pointing to Iceberg/Parquet in S3 or Glue.
• Eliminate ETL pipelines for accessing data lake files from Aurora.
• Join operational database rows with lakehouse data in a single query.
• Reduces storage costs by avoiding data duplication between DB and S3.

PgBouncer 1.26.0 has been released to address three security vulnerabilities, two of which can be exploited without authentication. The release resolves critical issues that could allow unauthorized actors to compromise the connection pooler layer.

• Two CVEs are triggerable without authentication, posing immediate risk.
• Upgrade to PgBouncer 1.26.0 to mitigate these specific vulnerabilities.
• Verify pooler logs for any suspicious activity prior to patching.

Chris van Eijk benchmarks row-level security overhead in PostgreSQL 17, highlighting how function volatility and specific query structures affect cost. The analysis reveals that wrapping policies in select statements and using membership subqueries can introduce significant latency. Additionally, the leakproof rule requirement may disable index usage, further degrading performance for sensitive data access.

• Function volatility directly impacts RLS execution cost; stable functions are preferred.
• Avoid wrapping RLS queries in select statements to reduce overhead.
• Membership subqueries can add measurable latency to policy evaluations.
• The leakproof rule may disable index scans, impacting query speed.
• Profile RLS policies in PG17 to identify specific performance bottlenecks.

An analysis of Row Level Security behind PgBouncer in transaction pooling mode reveals risks of tenant context leakage when SET LOCAL is used outside an active transaction. The study highlights how session parameters behave differently depending on transaction boundaries, potentially causing policy enforcement failures. Additionally, it identifies scenarios where distinct tenants may inadvertently share execution plans, impacting performance isolation.

• Tenant context can leak if SET LOCAL is issued outside a transaction block in transaction mode.
• Verify RLS policies with SET LOCAL to ensure parameters are applied before query execution.
• Monitor for shared execution plans across tenants to prevent performance interference.
• Review PgBouncer configuration to align transaction pooling with RLS security requirements.
• Test tenant isolation thoroughly when using transaction mode with dynamic security labels.

Amazon Redshift now allows direct querying of S3 tables located in different AWS Regions without data replication. Enhanced VPC routing ensures that query traffic remains within the customer's VPC, addressing security and compliance requirements. This capability is powered by the integrated data lake query engine running on both provisioned and Serverless cluster compute.

• Query S3 tables in other Regions directly without copying or replicating data first.
• Traffic stays within your VPC via enhanced routing for tighter security control.
• Supports global analytics and consolidated reporting across distributed data assets.
• Available on both provisioned Redshift clusters and Serverless capacity models.