> Now all Amazon needs to do is make Aurora HIPAA compliant/offer to sign a BAA and the dump trucks full of money will be backing up in no time. Can I dream?

Amazon already signs BAAs that cover EC2 dedicated instances and S3. Or do you mean BAAs that cover Aurora specifically?

FWIW, unless you're already a rather large company with excess capacity in both the engineering and legal teams, I'd recommend skipping AWS entirely and using a company like Aptible (YC S'14) to handle hosting and compliance[0]. It's more or less like using Heroku, except you have all of the compliance requirements (including legal documentation) managed for you. Having tried both approaches myself, I can testify that the latter is by far the preferable alternative (and honestly cheaper in the long run).

[0] Like Heroku, Aptible uses AWS under the hood, so it's not really "skipping" AWS, but you never have to deal with it directly (and that's a good thing).

I was referring to Aurora (or any RDS product for that matter) specifically.

RDS just cleared HIPAA and BAA. See here: http://aws.amazon.com/compliance/hipaa-compliance/

Working on Aurora...

Awesome! I must have missed that announcement. Thank you.

As I've heard it, RDS needs to support custom SSL certificates for connections. Not sure if there is a timeline for this, though.