Does Serverless V2 with MinCapacity 2.5 mean the cluster can scale all the way to zero when idle?

Not with a MinCapacity of 2.5, that value sets a floor, the cluster never scales below 2.5 NCUs even when completely idle, which means it's never truly at zero cost, but it also means no cold-start delay when a new query arrives after idle time. Setting a MinCapacity of 0 (where supported) allows true scale-to-zero but introduces a cold-start latency penalty for the first query after idle, it's a genuine cost-versus-latency tradeoff, not a free choice.

Can I use IAM authentication and a master password at the same time?

Yes, IamDatabaseAuthenticationEnabled adds IAM as an available authentication method alongside standard username/password authentication, it doesn't replace or disable the master credentials. This lets you migrate specific application components to IAM-based auth incrementally while other components keep using password auth during a transition.

What does neptune_query_timeout actually protect against?

It caps the maximum execution time (in milliseconds) for any single Gremlin, SPARQL, or openCypher query, protecting the cluster from a poorly-written or unexpectedly expensive graph traversal (say, an unbounded-depth path query) consuming resources indefinitely and degrading performance for other concurrent queries. Without it, one bad query can effectively become a self-inflicted denial-of-service against the whole cluster.

AWS Neptune Cluster Builder

StorageAWS

Build Neptune graph database cluster configurations with serverless scaling, IAM auth, and stream settings.

Amazon Neptune Configuration

Build Neptune graph database cluster configurations with serverless scaling, IAM auth, and stream settings.

Required Fields

DBClusterIdentifierEngineDBSubnetGroupNameInstances

{
  "DBClusterIdentifier": "prod-neptune-graph",
  "Engine": "neptune",
  "EngineVersion": "1.3.0.0",
  "DBSubnetGroupName": "neptune-subnet-group",
  "VpcSecurityGroupIds": ["sg-0abc123def456789a"],
  "Port": 8182,
  "StorageEncrypted": true,
  "KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-ef56-gh78-ij90-klmnopqrstuv",
  "BackupRetentionPeriod": 7,
  "PreferredBackupWindow": "02:00-03:00",
  "PreferredMaintenanceWindow": "sat:04:00-sat:05:00",
  "DeletionProtection": true,
  "IamDatabaseAuthenticationEnabled": true,
  "EnableCloudwatchLogsExports": ["audit", "slowquery"],
  "ServerlessV2ScalingConfiguration": {
    "MinCapacity": 2.5,
    "MaxCapacity": 128
  },
  "Instances": [
    {
      "DBInstanceIdentifier": "prod-neptune-writer",
      "DBInstanceClass": "db.serverless",
      "AvailabilityZone": "us-east-1a"
    },
    {
      "DBInstanceIdentifier": "prod-neptune-reader-1",
      "DBInstanceClass": "db.serverless",
      "AvailabilityZone": "us-east-1b"
    }
  ],
  "NeptuneClusterParameterGroup": {
    "Name": "custom-neptune-1-3",
    "Parameters": {
      "neptune_enable_audit_log": "1",
      "neptune_query_timeout": "120000",
      "neptune_streams": "1"
    }
  },
  "Tags": [
    {
      "Key": "Service",
      "Value": "knowledge-graph"
    }
  ]
}

Generated Output

Output will appear here...

About This Tool

Build a Neptune graph database cluster, optionally using Serverless V2 scaling (MinCapacity/MaxCapacity in Neptune Capacity Units) so the writer and reader instances scale compute automatically with query load rather than running fixed-size provisioned instances continuously. IamDatabaseAuthenticationEnabled lets IAM-based credentials authenticate to the cluster instead of (or alongside) a static database password, which matters for eliminating long-lived database credentials in favor of temporary, IAM-role-scoped access, but it needs the application's Gremlin/SPARQL/openCypher client configured to actually sign requests with SigV4, it's not a transparent drop-in for existing password-based client code.

When to Use This Tool

•Setting ServerlessV2ScalingConfiguration with a MinCapacity above zero (2.5 NCUs in the example, not zero) so the cluster maintains baseline responsiveness rather than fully scaling to zero and incurring a cold-start delay on the next query after an idle period.
•Enabling IamDatabaseAuthenticationEnabled for a Lambda-based application accessing Neptune, so the Lambda's execution role grants query access via short-lived IAM credentials rather than a long-lived database password stored in Secrets Manager or environment variables.
•Setting neptune_query_timeout in the cluster parameter group to bound how long a single Gremlin or SPARQL query can run, preventing one runaway graph traversal query from consuming cluster resources indefinitely.
•Enabling neptune_streams to expose a change-data-capture stream of graph mutations, useful for building a downstream event-driven pipeline reacting to graph updates (like re-indexing a search service when relationships change).

Pro Tips

TIP

IAM database authentication requires client-side SigV4 request signing, it's not a transparent swap for existing password-based Gremlin/SPARQL client code, budget for actual client library changes, not just a configuration flag flip on the cluster.

TIP

A Serverless V2 MinCapacity of 0 versus a small non-zero floor is a real latency-versus-cost tradeoff, don't default to 0 for a latency-sensitive production workload without testing what the actual cold-start delay looks like for your query patterns.

TIP

neptune_query_timeout should be set deliberately based on your legitimate slowest expected query, not left at an overly generous default, a timeout that's too permissive doesn't actually protect against the runaway-query scenario it's meant to guard against.

How It Works Under the Hood

The builder validates that DBClusterIdentifier, Engine, DBSubnetGroupName, and Instances all resolve before accepting the JSON as a valid combined cluster-plus-instance creation request, the fields Neptune needs to identify, network-place, and provision the cluster; it can't verify the referenced KMS key, subnet group, or security groups actually exist, those checks happen only against the live account.

Frequently Asked Questions

Does Serverless V2 with MinCapacity 2.5 mean the cluster can scale all the way to zero when idle?: Not with a MinCapacity of 2.5, that value sets a floor, the cluster never scales below 2.5 NCUs even when completely idle, which means it's never truly at zero cost, but it also means no cold-start delay when a new query arrives after idle time. Setting a MinCapacity of 0 (where supported) allows true scale-to-zero but introduces a cold-start latency penalty for the first query after idle, it's a genuine cost-versus-latency tradeoff, not a free choice.
Can I use IAM authentication and a master password at the same time?: Yes, IamDatabaseAuthenticationEnabled adds IAM as an available authentication method alongside standard username/password authentication, it doesn't replace or disable the master credentials. This lets you migrate specific application components to IAM-based auth incrementally while other components keep using password auth during a transition.
What does neptune_query_timeout actually protect against?: It caps the maximum execution time (in milliseconds) for any single Gremlin, SPARQL, or openCypher query, protecting the cluster from a poorly-written or unexpectedly expensive graph traversal (say, an unbounded-depth path query) consuming resources indefinitely and degrading performance for other concurrent queries. Without it, one bad query can effectively become a self-inflicted denial-of-service against the whole cluster.

Related Learning Guides

S3 Storage Classes Explained24 min read
DynamoDB Data Modeling28 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

AWS Neptune Cluster Builder

StorageAWS

Build Neptune graph database cluster configurations with serverless scaling, IAM auth, and stream settings.

Amazon Neptune Configuration

Build Neptune graph database cluster configurations with serverless scaling, IAM auth, and stream settings.

Required Fields

DBClusterIdentifierEngineDBSubnetGroupNameInstances

Generated Output

Output will appear here...

About This Tool

When to Use This Tool

•Setting ServerlessV2ScalingConfiguration with a MinCapacity above zero (2.5 NCUs in the example, not zero) so the cluster maintains baseline responsiveness rather than fully scaling to zero and incurring a cold-start delay on the next query after an idle period.
•Enabling IamDatabaseAuthenticationEnabled for a Lambda-based application accessing Neptune, so the Lambda's execution role grants query access via short-lived IAM credentials rather than a long-lived database password stored in Secrets Manager or environment variables.
•Setting neptune_query_timeout in the cluster parameter group to bound how long a single Gremlin or SPARQL query can run, preventing one runaway graph traversal query from consuming cluster resources indefinitely.
•Enabling neptune_streams to expose a change-data-capture stream of graph mutations, useful for building a downstream event-driven pipeline reacting to graph updates (like re-indexing a search service when relationships change).

Pro Tips

TIP

How It Works Under the Hood

Frequently Asked Questions

Does Serverless V2 with MinCapacity 2.5 mean the cluster can scale all the way to zero when idle?: Not with a MinCapacity of 2.5, that value sets a floor, the cluster never scales below 2.5 NCUs even when completely idle, which means it's never truly at zero cost, but it also means no cold-start delay when a new query arrives after idle time. Setting a MinCapacity of 0 (where supported) allows true scale-to-zero but introduces a cold-start latency penalty for the first query after idle, it's a genuine cost-versus-latency tradeoff, not a free choice.
Can I use IAM authentication and a master password at the same time?: Yes, IamDatabaseAuthenticationEnabled adds IAM as an available authentication method alongside standard username/password authentication, it doesn't replace or disable the master credentials. This lets you migrate specific application components to IAM-based auth incrementally while other components keep using password auth during a transition.
What does neptune_query_timeout actually protect against?: It caps the maximum execution time (in milliseconds) for any single Gremlin, SPARQL, or openCypher query, protecting the cluster from a poorly-written or unexpectedly expensive graph traversal (say, an unbounded-depth path query) consuming resources indefinitely and degrading performance for other concurrent queries. Without it, one bad query can effectively become a self-inflicted denial-of-service against the whole cluster.

Related Learning Guides

S3 Storage Classes Explained24 min read
DynamoDB Data Modeling28 min read

Was this tool helpful?