Amazon DocumentDB Best Practices (with MongoDB).pptx

© 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
Best Practices for
Amazon
DocumentDB

Agenda
• Cluster Sizing
• Connecting
• Scaling
• Cross Region Replication
• Monitoring
• Indexing
• Cost Optimization
• Security

Amazon DocumentDB (with MongoDB compatibility)
Fully managed and scalable
document database service that
supports MongoDB workloads
Scalable
Fully managed
MongoDB API
compatible

AWS Region
Amazon DocumentDB (with MongoDB compatibility)
Compute
2-96 cores
4-768 GB RAM
Storag
e
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Backup
AZ 1 AZ 2 AZ 3
Amazon S3
Distributed storage volume

Amazon
DocumentDB Cluster
Sizing

Number of instances determines availability target
Availability Target Total Instances Replicas Availability Zones
Recovery
Time
99% 1 0 1 8-10min
99.9% 2 1 2 <30sec
99.99% 3 2 3 <30sec
99.99% 4 3 3 <30sec
Best Practice: Use at least 2 replicas in different AZs for production deployments
Cluster Sizing: Availability

Instance Size = Processing Power + Cache
Class vCPU Memory (GiB) Estimated Cache Size
(~2/3 of RAM)
t4g.medium 2 4 ~2.5GB
r6g.large 2 16 ~10.5GB
r6g.xlarge 4 32 ~21GB
r6g.2xlarge 8 64 ~42.5GB
r6g.4xlarge 16 128 ~85GB
r6g.12xlarge 48 384 ~256GB
r6g.16xlarge 64 512 ~341GB
r5.24xlarge 96 768 ~512GB
Best Practice: Ensure indices and working set fit in cache
Cluster Sizing: Instance Performance

Recover to any time from 5 minutes ago until the Backup Retention Period
Best practice: set retention based on your Recovery Point Objective
Cluster Sizing: Backups

Connecting to
Amazon
DocumentDB

Connecting: Endpoints
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint

AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint
Cluster Endpoint

AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint
Instance
(replica)
Reads
Instance Endpoint
Cluster Endpoint Reader Endpoint

AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Instance
(replica)
Reads
"members":[
{
"_id":1,
"stateStr":"PRIMARY",
...
},
{
"_id": 2,
"stateStr":"SECONDARY",
...
},
{
"_id":3,
"stateStr":"SECONDARY",
...
}
]
Application

Best practice: Use cluster endpoint and connect as a replica set
Connecting: Replica Set Emulation

© 2023, Amazon Web Services, Inc. or its Affiliates.
Connecting: Failover
AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads

AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Primary fails

AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
Replica promoted to new primary
Instance
(primary
)
Reads
Writes

AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
~8-10 mins
Instance
(replica)
Reads
New replica instance created
Automatic return to full strength
Instance
(primary
)
Reads
Writes

Instance
(Primary)
AZ1 AZ2 AZ3
Reads
Instance
(Replica)
Instance
(Replica)
Reads
Writes
Reads
Containers
Up to
30000
Up to
30000
Up to
30000
Connection Limits

Instance
(Primary)
AZ1 AZ2 AZ3
Reads
Instance
(Replica)
Instance
(Replica)
Reads
Writes
Reads
Containers
Up to
4560
Up to
4560
Up to
4560
Cursor Limits

Scaling Amazon
DocumentDB

Scaling: Read Consistency
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes Instance
(replica)
Reads
Primary reads are read-after-write consistent

Scaling: Read Consistency
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes Instance
(replica)
Reads
Typically
~10-100ms
Primary reads are read-after-write consistent
Replica reads are eventually consistent

Scaling: Read Preference
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Writes
Instance
(replica)
Reads
Instance
(replica)
Reads
Application
Read Preference:
secondaryPreferre
d

AZ 1 AZ 2 AZ 3
Instance
(primary
)
Writes
Instance
(replica)
Instance
(replica)
Reads
Application
Read Preference:
secondaryPreferre
d

AZ 1 AZ 2 AZ 3
Instance
(replica)
Instance
(replica)
Application
Read Preference:
secondaryPreferre
d
Instance
(primary
)
Reads
Writes

Scaling: Read Traffic
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Instance
(replica)
Reads
Application

Scaling: Read Traffic
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Instance
(replica)
Reads
Application
Instance
(replica)
Reads
Up to 15 read replicas

Scaling: Dynamic Read Preference
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Instance
(replica)
Reads
Application
Override on each call
(readPreference:
primary)
Default read preference
(readPreference:
secondaryPreferred)

Scaling: Asymmetric Workloads
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
db.r6g.large
Instance
(replica)
Reads
db.r6g.large
Instance
(replica)
Reads
db.r6g.large

Scaling: Asymmetric Workloads
AZ 1 AZ 2 AZ 3
Instance
(primary
)
Reads
Writes
db.r6g.large
Instance
(replica)
Reads
db.r6g.large
Instance
(replica)
Reads
db.r6g.large
Instance
(replica)
Reads
db.r6g.12xlarge
Instance Endpoint

Scaling: Write Traffic
AZ 1 AZ 2 AZ 3
Reads
Writes
Primary
db.r6g.large
Reads
Replica
db.r6g.large
Reads
Replica
db.r6g.large

AZ 1 AZ 2 AZ 3
Reads
Writes
Primary
db.r6g.large
Reads
Replica
db.r6g.large
Reads
Replica
db.r6g.large
Reads
Replica
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge

AZ 1 AZ 2 AZ 3
Reads
Writes
Replica
db.r6g.large
Reads
Replica
db.r6g.large
Reads
Replica
db.r6g.large
Reads
Primary
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge
Writes

AZ 1 AZ 2 AZ 3
Reads
Primary
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge
Reads
Replica
db.r6g.4xlarge
Writes

Compute
Storage
Scaling: Storage and I/O
AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads

Compute
Storage
Scaling: Storage and I/O
Grows automatically from
10 GiB - 128 TiB
AZ 1 AZ 2 AZ 3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads

Cross Region Replication
with Amazon DocumentDB

App 1
db.foo.findOne(
)
{“x”:1}
Global replication: Up to 5 secondary
regions
Low replica lag: Typically < 1 sec
Fast recovery: Typically < 1 min downtime
Compatibility: Version 4.0 and later
Global reader instances: Up to 90
db.foo.insertOne({“x”:1}
)
Reads
Reads
Writes
Reads
Replicatio
n
Service
(primary region)
Ohio
Reads
Reads
Replicatio
n
Service
(secondary region)
Oregon
Reads
Reads
Replicatio
n
Service
(secondary region)
Tokyo
App 2
Global Clusters

Global Clusters – Setup & Operations
• Use same cluster parameter group setting on primary and secondaries
• Use same sized instance on secondary cluster(s)
• Externalize application endpoints
• Failover
 Stop Application from writing to primary
 Identify secondary to promote based on latency for end users
 Remove and promote identified secondary to primary
 Point application to new primary (standalone)
 Delete old primary and other secondaries
• Automate failover process

Monitoring Amazon
DocumentDB

• Create billing alarms
• 50% spend
• 75% spend
•Cost Allocation Tags
Monitoring: Billing

BufferCacheHitRatio
IndexBufferCacheHitRatio
DatabaseConnections
DatabaseCursors
FreeableMemory
CPUUtilization
Monitoring: Instance Metrics

DBClusterReplicaLagMaximum
DatabaseCursorsTimedOut
VolumeWriteIOPs
VolumeReadIOPs
Opscounters
Monitoring: Cluster Metrics

Auditing
DDL events
Auth events
Role Grants
Create alarms
Profiling
Slow queries
Monitoring: Auditing and Profiling

Review historical system
activity by measuring
database load
• Average Active Sessions
• Wait States
• Operation level
granularity
Complementary to profiling
Monitoring: Performance Insights

Indexing Amazon
DocumentDB

• Indexes come with a cost
• Constrain indexes to those
necessary for common queries
• 5 per collection max
rule of thumb
• 1% selectivity goal
rs0:PRIMARY> db.collName.getIndexes()
[
{
"v":2,
"key":{
"_id":1
},
"name":"_id_",
"ns":"tournament.results"
},
{
"v":2,
"key":{
"user_id":1
},
"name":"user_id_1",
"ns":"tournament.results"
}
]
Indexing

• Verify indexes fit in memory
• Monitor IndexBufferCacheHitRatio
rs0:PRIMARY> db.collName.stats()
{
"ns":"tournament.results",
"count":39549,
"size":7000173,
"avgObjSize":177.303,
"storageSize":8609792,
"capped":false,
"nindexes":2,
"totalIndexSize":5472256,
"indexSizes":{
"_id_":2760704,
"user_id_1":2711552
},
"ok":1
}
Indexing: Caching

Drop unused indexes where possible
rs0:PRIMARY> db.collName.aggregate([{$indexStats:{}}]).pretty()
{
"name":"user_id_1",
"key":{
"user_id":1
},
"host":"docdb2019.us-east-2.docdb.amazonaws.com:27017",
"accesses":{
"ops":NumberLong(0),
"since":ISODate("2020-01-15T06:57:38Z")
}
}
Indexing: Unused Indexes

Optimizing Costs in Amazon
DocumentDB

Compute
Storage
Cost Optimization: Pricing
Amazon S3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads

Compute
Storage
Amazon S3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Instances: Size/hr * count (db.t4g.medium $0.075/hr)
1

Compute
Storage
Amazon S3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
1
IOPS: Count ($0.20/million)
2

Compute
Storage
Amazon S3
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Storage: GiB/month ($0.10/GiB)
3
1
2

Compute
Storage
Amazon S3
Backup: GiB/month (100% Free! $0.021/GiB)
4
Instance
(replica)
Reads
Instance
(primary
)
Reads
Writes
Instance
(replica)
Reads
Storage: GiB/month ($0.10/GiB)
3
1
2

Class vCPU Memory (GiB) Estimated Cache
Size
t4g.medium 2 4 ~2.5GB
r6g.large 2 16 ~10.5GB
r6g.xlarge 4 32 ~21GB
r6g.2xlarge 8 64 ~42.5GB
r6g.8xlarge
r6g.12xlarge
r6g.16xlarge 48 384 ~256GB
r5.24xlarge 96 768 ~512GB
Availability
Target
Total
Instance
s
Replicas
Availability
Zones
Recovery
Time
99% 1 0 1 8-10min
99.9% 2 1 2 <30sec
99.99% 3 2 3 <30sec
99.99% 4 3 3 <30sec
Cost Optimization: Cluster Sizing

• Stops for up to 7 days; cluster then restarts automatically
• While Stopped:
• No instance costs
• Storage costs continue
• Backup costs do not increase
Cost Optimization: Start/Stop Cluster

Cost Optimization: I/O
• Choose appropriate instance size
 Working set and indices should fit in cache
 Monitor metrics to ensure cache is appropriately sized
– BufferCacheHitRatio and IndexBufferCacheHitRatio
– Should be >90%
• Special Case: TTL workloads
 TTL indices incur I/O to drop the data
 Instead use a collection per day
– Query all collections for the data of interest
– Drop entire collection when the data “expires”
No I/O cost to drop a collection

Cost Optimization: Storage and Backup
• Store only what you need
 Identify unused indices
 Identify unneeded data
– Unneeded fields in documents
– Unneeded documents
• Only keep necessary backups
 Pay attention to snapshots
– Remove ones you no longer need
 Assess your recovery point objective
– Adjust your backup retention period appropriately

Securing Amazon
DocumentDB

Security group B
VPC
Security group A
Application DocumentDB Cluster
Security group B:
• Inbound (min): TCP (27017)
Security group A:
• Outbound (min): TCP (27017)
Security Groups

Role
Scope
Role Name Description Actions
Database read Read any collection in a
DB
collStats, dbStats, find,
listCollections, …
Database readWrite Read and write any
collection in a DB
createCollection,,
createIndex, insert, remove,
update, …
Cluster readAnyDatabase Read any collection in
any DB
listChangeStreams,
listDatabases, [actions in
read]
Cluster readWriteAnyDatabase Read or write any
collection in any DB
listChangeStreams,
listDatabases, [actions in
readWrite]
Cluster clusterMonitor Read access for
monitoring tools
listSessions, serverStatus,
top, dbStats, …
RBAC – Built-in Roles

RBAC – User Defined Roles
• Roles determine operation an user can perform on DB resources
• User-defined roles provides flexibility to customize RBAC roles based on
organization needs
• Allows to create users with fine grain access control a.k.a least privilege access
• Create roles to restrict access to specific operations / API
• Create roles to restrict access to specific collections
• Allows adding built in role or access to operations, to an existing user defined role

Auditing and Profiling
• Auditing
 All authentication events (success and failure)
 All permission grant operations
 Monitoring and Alerts via CloudWatch
• Cluster Deleting Protection
 Enabled / disabled in cluster configuration

• Use TLS in-transit
• KMS-backed at-rest
encryption
Encryption

AWS Secrets Manager
Amazon DocumentDB
Application
Lambda Rotation
Function
Retrieve credentials
Login with credentials
Update credentials
Trigger update
Integration with AWS Secrets Manager

https://aws.amazon.com/documentdb/
Thank you!

Amazon DocumentDB Best Practices (with MongoDB).pptx

More Related Content

Similar to Amazon DocumentDB Best Practices (with MongoDB).pptx

Recently uploaded

Amazon DocumentDB Best Practices (with MongoDB).pptx