Modifying an RDS Custom for SQL Server Single-AZ deployment to a Multi-AZ deployment

To configure the RDS Custom for SQL Server Multi-AZ deployment prerequisites using CloudFormation

1. Open the CloudFormation console at https://console.aws.amazon.com/cloudformation.

2. To start the Create Stack wizard, select the existing stack you used to create a Single-AZ deployment and choose Update.

   The Update stack page appears.

3. For Prerequisite - Prepare template, choose Replace current template.

4. For Specify template, do the following:

   1. Download the latest AWS CloudFormation template file. Open the context (right-click) menu for the link custom-sqlserver-onboard.zip and choose Save Link As.

   2. Save and extract the custom-sqlserver-onboard.json file to your computer.

   3. For Template source, choose Upload a template file.

   4. For Choose file, navigate to and then choose custom-sqlserver-onboard.json.

5. Choose Next.

   The Specify stack details page appears.

6. To keep the default options, choose Next.

   The Advanced Options page appears.

7. To keep the default options, choose Next.

8. To keep the default options, choose Next.

9. On the Review Changes page, do the following:

   1. For Capabilities, select the I acknowledge that AWS CloudFormation might create IAM resources with custom names check box.

   2. Choose Submit.

10. Verify the update is successful. The status of a successful operation shows UPDATE_COMPLETE.

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. Choose Endpoint. The Create Endpoint page appears.

3. For Service Category, choose AWS services.

4. In Services, search for SQS

5. In VPC, choose the VPC where your RDS Custom for SQL Server DB instance is deployed.

6. In Subnets, choose the subnets where your RDS Custom for SQL Server DB instance is deployed.

7. In Security Groups, choose the -vpc-endpoint-sg group.

8. For Policy, choose Custom

9. In your custom policy, replace the AWS partition, Region, accountId,and IAM-Instance-role with your own values.

   
                        {
           "Version": "2012-10-17",
           "Statement": [
               {
                   "Condition": {
                       "StringLike": {
                           "aws:ResourceTag/AWSRDSCustom": "custom-sqlserver"
                       }
                   },
                   "Action": [
                       "SQS:SendMessage",
                       "SQS:ReceiveMessage",
                       "SQS:DeleteMessage",
                       "SQS:GetQueueUrl"
                   ],
                   "Resource": "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:do-not-delete-rds-custom-*",
                   "Effect": "Allow",
                   "Principal": {
                       "AWS": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/{IAM-Instance-role}"
                   }
               }
           ]
       }   
                       

10. Update the Instance profile with permission to access Amazon SQS. Replace the AWS partition, Region, and accountId with your own values.

    
                            {
        "Sid": "SendMessageToSQSQueue",
        "Effect": "Allow",
        "Action": [
          "SQS:SendMessage",
          "SQS:ReceiveMessage",
          "SQS:DeleteMessage",                                    
          "SQS:GetQueueUrl"
    
        ],
        "Resource": [
          {
            "Fn::Sub": "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:do-not-delete-rds-custom-*"
          }
        ],
        "Condition": {
          "StringLike": {
            "aws:ResourceTag/AWSRDSCustom": "custom-sqlserver"
          }
        }
      } 
                            >
                        

11. Update the Amazon RDS security group inbound and outbound rules to allow port 1120.

    1. In Security Groups, choose the -rds-custom-instance-sg group.

    2. For Inbound Rules, create a Custom TCP rule to allow port 1120 from the source -rds-custom-instance-sg group.

    3. For Outbound Rules, create a Custom TCP rule to allow port 1120 to the destination -rds-custom-instance-sg group.

12. Add a rule in your private network Access Control List (ACL) that allows TCP ports 0-65535 for the source subnet of the DB instance.

    Note

    When creating an Inbound Rule and Outbound Rule, take note of the highest existing Rule number. The new rules you create must have a Rule number lower than 100 and not match any existing Rule number.

    1. In Network ACLs, choose the -private-network-acl group.

    2. For Inbound Rules, create an All TCP rule to allow TCP ports 0-65535 with a source from privatesubnet1 and privatesubnet2.

    3. For Outbound Rules, create an All TCP rule to allow TCP ports 0-65535 to destination privatesubnet1 and privatesubnet2.