Constraints below are documented in the AWS Aurora User Guide; verify current constraints before acting. Each bullet cites its source; those subject to change are marked.
Engine version is the AWS default for this flow — The express flow does not expose the full engine-version picker; verify the current default in the Aurora PostgreSQL User Guide (opens in a new tab). Versions can be upgraded later via modify. Subject to change.
Extensions and engine features follow the selected version — Any extension or feature unavailable in the version AWS picks is unavailable in the cluster. Source: extensions (opens in a new tab). Subject to change.
AWS-managed connectivity only — The routing layer terminating PostgreSQL connections is AWS-managed and not customer-configurable; customers cannot attach, peer, or modify it. Source: same page above.
No customer route tables, NACLs, or Transit Gateway attachments — All customer-side network policy controls are VPC-dependent and do not apply. Source: Create with express configuration (opens in a new tab). Subject to change.
Aurora serverless only during create — Express clusters are created with a serverless instance only; change it later via modify instance. Provisioned instance classes (for example, r7g.xlarge) are not selectable during create. Source: Aurora serverless User Guide (opens in a new tab).
Default min/max ACU range — The express flow applies the AWS default serverless capacity range (verify current values); you can modify min/max during create.
Aurora Standard storage at create; switchable after — At create time express clusters can only use Aurora Standard storage; Aurora I/O-Optimized is not selectable during express create. Change the storage type after creation. Source: Create with express configuration (opens in a new tab) (Limitations and Express configuration settings table — “Cluster storage configuration: Aurora standard by default. Can be changed after the create operation completes.”).
Backup retention defaults — The retention window applied at creation is the Aurora default for this flow; verify in the Aurora backups User Guide (opens in a new tab). Subject to change.
AWS owned key for encryption at rest — Express clusters are encrypted at rest with an AWS owned key (SSE-RDS), an AWS-controlled key customers cannot view or manage; this is distinct from the AWS managed key (aws/rds). Customer-managed KMS keys (CMKs) belong to the Full Configuration flow, where the user selects a KMS key at creation. Source: Encrypting Amazon Aurora resources (opens in a new tab). Subject to change.
IAM database authentication (REQUIRED for express) — Express clusters only support IAM authentication through the internet access gateway. The master user (postgres) is automatically configured for IAM authentication during create, and subsequent database users must be too. There is no password-based auth on the master user. See IAM database authentication for Aurora (opens in a new tab).
No Secrets Manager / managed master user password — Express clusters do NOT support Secrets-Manager-backed master passwords. The internet access gateway only supports IAM authentication, so no password is created or stored for the master user. Do NOT use --manage-master-user-password or set a password manually on an express cluster — see Password management with AWS Secrets Manager (opens in a new tab) for the full-configuration alternative.
Features depending on VPC-only connectivity are unavailable — VPC endpoints, customer VPC peering, PrivateLink-only routing, and any integration requiring the cluster to be reachable from inside a customer VPC. Source: express configuration (opens in a new tab).
Custom parameter groups — The default cluster parameter group applies at creation; apply a custom parameter group after the cluster is created. See Aurora PostgreSQL parameters (opens in a new tab).
Customer security groups — Not applicable in the express flow (see Networking constraints).
Aurora Global Database — NOT supported. AWS lists it among unsupported features (express clusters are not associated with a VPC). Source: Limitations (opens in a new tab).
Aurora Zero-ETL integrations — NOT supported. A documented hard limitation (no VPC association). Source: Limitations (opens in a new tab).
Blue/Green deployments — NOT supported. The AWS Limitations list explicitly names Blue/Green Deployments (along with Aurora Limitless, Aurora Global Database, RDS Proxy, Aurora Zero-ETL, RDS Query Editor, Database Activity Streams, Zero Downtime Patching, and Babelfish) as unsupported, since express clusters are not associated with a VPC. Source: Limitations (opens in a new tab).
RDS Data API — Can be enabled after creation using ModifyDBCluster. However, Data API on an express cluster does NOT support master username/password authentication — you must create new user credentials in the database for Data API access. See RDS Data API User Guide (opens in a new tab).
Express Configuration does not offer full feature parity with Full Configuration. Where the AWS documentation identifies a gap, assume the capability is unavailable in the express flow until AWS documents otherwise. Source: Create with express configuration (opens in a new tab).