Acceptance Criteria: RDS in private subnets, encryption at rest/in transit, automated backups, Multi-AZ, security groups. Priority: P0, Estimate: 1 day