At a glance
| Supported databases | Aurora PostgreSQL, Aurora MySQL, RDS for Oracle 19c, RDS for SQL Server 2016 to 2019 |
| Auditing and activity monitoring | Yes: activity stream to Kinesis; analysis needs a consumer |
| Masking | Not part of the feature |
| Encryption or tokenization | Stream encrypted with AWS KMS (no data tokenization) |
| Privileged access | Separates DBAs from the audit stream; no access management |
| Policy enforcement | None; it records, it does not block |
| Compliance reporting | Via consuming tools (for example IBM Guardium or Imperva) |
| Deployment | Managed AWS feature; Kinesis and KMS required |
| Licensing | Feature free; Kinesis Data Streams and KMS charges apply |
| Not supported | Aurora Serverless, Babelfish for Aurora PostgreSQL, RDS for MySQL, MariaDB, PostgreSQL and Db2, Oracle 21c and later, RDS read replicas |
Database Activity Streams is the AWS-native way to get a tamper-resistant activity feed out of Aurora or RDS without agents, with DBAs kept out of the collection path. It is a transport, not an analysis product: you still need Firehose and storage, your own Lambda code, or a third-party monitor to turn the stream into alerts and reports.
Overview
Database Activity Streams (DAS) sends database activity from Aurora clusters and RDS DB instances to an Amazon Kinesis data stream that AWS creates automatically. Events arrive as encrypted JSON records (a DatabaseActivityMonitoringRecord with a databaseActivityEventList array), protected with your AWS KMS key. AWS positions it against insider threats: DBAs have no access to the collection, transmission, storage and processing of the stream. From Kinesis, Amazon Data Firehose, AWS Lambda or a compliance application can consume it.
In Aurora you start the stream at cluster level and every instance is covered; Aurora PostgreSQL supports synchronous mode (favouring completeness) as well as asynchronous mode, while Aurora MySQL is asynchronous only. In RDS, streams are always asynchronous, you define what to capture with Oracle unified audit policies or SQL Server audit specifications, and once the stream is on a DBA cannot change those policies or remove audit logs. AWS names IBM Security Guardium and Imperva SecureSphere Database Audit and Protection as compliance applications for Aurora PostgreSQL streams.
Key features
- Near real-time activity stream to an automatically created Amazon Kinesis data stream
- Always encrypted with a customer AWS KMS key; DBAs excluded from the collection path
- Synchronous or asynchronous mode for Aurora PostgreSQL; asynchronous for Aurora MySQL and RDS
- Cluster-level enablement in Aurora covering every instance, and Multi-AZ coverage in RDS
- Audit policies locked against DBA changes while the stream runs (RDS for Oracle and SQL Server)
- Optional engine-native audit fields in the JSON records for RDS for Oracle and SQL Server
Integrations and ecosystem
Pros and cons
Pros
- No agents and no extra licence: enabled from the console or CLI
- DBAs cannot tamper with the stream or, on RDS, with locked audit policies
- Synchronous mode on Aurora PostgreSQL for audit completeness
- Documented consumers include IBM Guardium and Imperva
Cons
- Not available on RDS for MySQL, MariaDB, PostgreSQL or Db2, or on Aurora Serverless
- Delivers raw encrypted records; you build or buy the analysis layer
- Asynchronous mode can lose records during errors (AWS sends an event marking the gap)
- Aurora PostgreSQL streams must be stopped before a major version upgrade
Pricing
AWS documents the feature itself as free in both Aurora and RDS, but it only runs on a paid Aurora cluster or RDS DB instance on the supported instance classes AWS lists, and Amazon Kinesis Data Streams charges for the data stream it creates, at Kinesis rates. AWS KMS is required because streams are always encrypted, so KMS key charges apply too. Any consuming tool (Firehose, Lambda, storage, or a third-party monitor) is billed separately.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
AWS teams running Aurora or RDS for Oracle or SQL Server who need a tamper-resistant activity feed for a SIEM or a third-party database activity monitor.
Typical use cases
- Feeding Aurora PostgreSQL activity into IBM Guardium or Imperva for compliance reporting
- Archiving encrypted audit records to Amazon S3 through Amazon Data Firehose
- Triggering Lambda alerts on privileged or unusual activity
- Meeting separation-of-duties rules that keep DBAs out of the audit trail
Who should look elsewhere
- RDS for MySQL or PostgreSQL users, where DAS is not available: use engine audit logs or a tool such as DataSunrise.
Verdict
Database Activity Streams gives Aurora and selected RDS engines a tamper-resistant, agentless activity feed at the cost of Kinesis and KMS usage. It is a strong building block for compliance monitoring on AWS, but on its own it produces no alerts or reports, and its engine coverage has notable gaps.
Frequently asked questions
Which databases support Database Activity Streams?
Aurora PostgreSQL and Aurora MySQL (provisioned clusters, not Aurora Serverless or Babelfish), RDS for Oracle 19c Enterprise and Standard Edition 2, and RDS for SQL Server 2016, 2017 and 2019. RDS for MySQL, MariaDB, PostgreSQL and Db2 are not supported.
What does Database Activity Streams cost?
AWS says the feature is free, but Amazon Kinesis Data Streams charges for the stream it creates, KMS is required for encryption, and whatever consumes the stream is billed separately.
Is it synchronous?
Only on Aurora PostgreSQL, which offers synchronous and asynchronous modes. Aurora MySQL and all RDS engines run asynchronously, which favours database performance and can drop records during errors, flagged by an RDS event.
Can third-party tools read the stream?
Yes. AWS names IBM Security Guardium and Imperva SecureSphere Database Audit and Protection as compliance applications for Aurora PostgreSQL streams; any consumer must decrypt records with your KMS key.
Sources
- Amazon Aurora User Guide: Database Activity Streams
- Aurora: supported Regions and engines for activity streams
- Amazon RDS User Guide: Database Activity Streams
- RDS: supported Regions and engines for activity streams
- Amazon Kinesis Data Streams pricing
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.