# Amazon EC2 High Availability for SQL Server on Amazon EC2
Amazon EC2 High Availability for SQL Server (SQL HA) allows you to configure Amazon EC2 instances running license-included SQL Server as part of a HA cluster to reduce licensing costs. This feature identifies the SQL Server standby (also known as passive) instances in your SQL HA deployments and waives SQL Server licensing fees for them, allowing you to pay only Windows rates for these standby instances while maintaining your HA configuration.
## Supported SQL Server High Availability deployments
SQL HA supports two SQL Server High Availability deployments, including:
+ Always On Availability Groups
+ Always On Failover Cluster Instances
For Always On Availability Groups, SQL HA identifies primary and secondary (also knows as standby or passive) replicas and waives the SQL Server licenses on the secondary replicas (Amazon EC2 instances) that are not actively serving read traffic. For Failover Cluster Instances, SQL HA recognizes which instances are active and which are standing by for failover scenarios and waives the SQL Server licenses on the standby instances. For more information about the SQL HA configurations, see [Deploy SQL Server on Amazon EC2](create-sql-server-on-ec2-instance.md)
## Considerations and requirements
+ SQL HA supports two Amazon EC2 instances (also known as nodes) per SQL Server HA cluster.
+ The SQL HA active instance should have equal or more vCPUs than the standby instance.
+ SQL HA saves license costs for SQL Server license-included only. For more information, see [SQL Server licensing options](sql-server-on-ec2-licensing.md#sql-server-on-ec2-licensing-options-included).
+ SQL HA only supports multi-AZ deployments within the same region. Cross-region deployments are not supported.
+ The SQL Server standby node must meet requirements to receive the license savings, including: 1. Does not serve incoming traffic; 2. Does not run active SQL Server workloads; 3. Is not a readable secondary (except master, msdb, tempdb, or model databases); 4. For Always On Availability Groups, there is no standalone database running outside of the Availability Group.
+ SQL HA supports SQL Server (Standard and Enterprise Editions) 2017 and later on Windows Server 2019 and later.
+ Windows PowerShell must be 5.1 or above.
+ Amazon EC2 Reserved Instances are not supported by SQL HA. If you are using Reserved Instances, discounts may not be applied to these instances in the same payer account. We recommend using Savings Plans instead to benefit from both SQL HA license savings and Savings Plans compute cost savings. For more information, see the [Savings Plans User Guide](https://docs.aws.amazon.com/savingsplans/latest/userguide/what-is-savings-plans.html).
+ This feature may be terminated at any time, in which case AWS will provide you with as much prior notice as is reasonably practicable under the circumstances.
## Prerequisites
To get the license savings for your SQL HA workload, your environment must meet several requirements:
+ You have SQL Server license-included HA workloads on Amazon EC2. You can use AWS Launch Wizard to simplify the SQL Server deployment on Amazon EC2. For more information, see [AWS Launch Wizard for SQL Server](https://docs.aws.amazon.com/launchwizard/latest/userguide/launch-wizard-sql.html).
+ AWS Systems Manager Agent (SSM Agent) must be installed and running on the instances in the SQL HA deployment. For more information, see [Working with SSM Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html).
+ You must attach the **AWSEC2SqlHaInstancePolicy** managed policy to your instance role or use a custom role with the required permissions for the Amazon EC2 to access your instances, including permissions for AWS Systems Manager to run commands, access to AWS Secrets Manager for retrieving SQL Server credentials, and Amazon EC2 permissions to read instance metadata.
+ By default, AWS Systems Manager uses the built-in `[NT AUTHORITY\SYSTEM]` user to access SQL Server HA metadata. You will need to store secrets in AWS Secrets Manager only when your security policies have restricted or disabled the `[NT AUTHORITY\SYSTEM]` account.
+ Network connectivity allows AWS Systems Manager commands to reach your instances.
# How Amazon EC2 High Availability for SQL Server works
Upon registration, Amazon EC2 High Availability for SQL Server (SQL HA) automatically monitors your Amazon EC2 instances running Windows SQL Server License Included AMIs and classifies them as either active or standby based on their current role in your SQL Server deployment. For High Availability configurations containing an active SQL Server instance, one standby failover instance in the same cluster may receive a SQL Server licensing fee waiver, meaning you pay only the Windows Server licensing fee. You can monitor your current SQL HA status through the Amazon EC2 console, which displays the latest records of which instances are receiving license savings and historical status changes.
SQL HA continuously monitors your enabled SQL Server instances to determine their active or standby status. Using AWS Systems Manager (SSM) commands, it collects metadata from your SQL Server installations and applies classification logic to identify which instances are actively serving traffic and which are functioning as standby failover nodes.
Standby instances are billed as Windows instances rather than Windows SQL Server instances, providing license cost savings. Billing changes take effect when an SQL HA standby detection enabled instance is classified as standby and eligible for the benefit, with no manual intervention required. This classification adapts to changes in your environment, such as failover events where a standby instance becomes active. The system detects these transitions and updates billing accordingly.
# Getting started with Amazon EC2 High Availability for SQL Server
To get started with Amazon EC2 High Availability for SQL Server (SQL HA), perform the following steps:
**Topics**
+ [Step 1: Set up SSM Agent](#sql-high-availability-ssm)
+ [Step 2: Attach AWS managed policy to instances](#sql-high-availability-role)
+ [Step 3: (*Optional*) Store SQL Server credentials in AWS Secrets Manager](#sql-high-availability-secret)
+ [Step 4: EnableSQL HA license savings](#sql-high-availability-register)
+ [Windows user setup](sql-high-availability-windows-user-setup.md)
## Step 1: Set up SSM Agent
The Systems Manager Agent (SSM Agent) must be installed and running on the Amazon EC2 SQL Server instances with the High Availability deployments. The SSM Agent executes an SSM document to determine and report the SQL HA state for the instance.
The SSM Agent is preinstalled, by default, on the Amazon Machine Images (AMIs) for Windows and SQL Server provided by Amazon. For more information, see [AWS Windows AMIs](https://docs.aws.amazon.com/ec2/latest/windows-ami-reference/windows-amis.html). To check if SSM Agent is correctly configured on your instances, you can use the System Manager console, or call [ DescribeInstanceInformation](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceInformation.html) to verify the SSM Agent [ PingStatus](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_InstanceInformation.html#systemsmanager-Type-InstanceInformation-PingStatus) is Online. If necessary, you can manually download and install the latest version of SSM Agent on your Amazon EC2 SQL Server instances. For more information, see [ Manually install the SSM Agent on Amazon EC2 instances for Windows Server](https://docs.aws.amazon.com/systems-manager/latest/userguide/manually-install-ssm-agent-windows.html).
## Step 2: Attach AWS managed policy to instances
To ensure that your instance has the required IAM permissions, you must attach the following AWS managed policies to the instance:
+ **AWSEC2SqlHaInstancePolicy** — grants permissions for SQL HA to execute AWS Systems Manager (SSM) Run Command document `AWSEC2-DetectSqlHaState` to automatically detect the standby state of your SQL Server instances.
+ **AmazonSSMManagedInstanceCore** — enables AWS Systems Manager service core functionality.
For more information, see Attach an IAM role to an Amazon EC2 instance.
**Note**
If needed, you can create and attach your own custom IAM role. However, at a minimum, the role must include all of the permissions that are included in the **AWSEC2SqlHaInstancePolicy** AWS managed policy.
## Step 3: (*Optional*) Store SQL Server credentials in AWS Secrets Manager
**By default**, AWS Systems Manager uses the built-in `[NT AUTHORITY\SYSTEM]` user to access SQL Server HA metadata. If you choose to use the built-in `[NT AUTHORITY\SYSTEM]` user, you may need to configure Windows user permissions to ensure the service can obtain High Availability metadata from your SQL Server instances. For more information, see [Windows user setup for Amazon EC2 High Availability for SQL Server](sql-high-availability-windows-user-setup.md).
**Alternatively**, if your security policies have restricted or disabled the `[NT AUTHORITY\SYSTEM]` account, you will need to store and use your SQL Server credentials in AWS Secrets Manager. For more information, see [ Create a secret in AWS Secrets Manager with appropriate SQL Server permissions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_secret.html).
## Step 4: EnableSQL HA license savings
You must enable SQL HA standby detection for Windows SQL Server license-included instances to receive SQL Server license savings. Use one of the following methods:
------
#### [ Console ]
1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/).
1. In the navigation panel, choose **Instances**.
1. Select the instances in the High Availability deployment to enable SQL HA standby detection monitoring, choose **Actions**, **Instance settings**, **Modify SQL High Availability settings**.
1. In the **Review prerequisites** step, review each instance to make sure it is configured correctly.
+ The **SSM agent status** column indicates the state of the SSM Agent on the instance. **Online** indicates that the SSM Agent is running and accessible.
+ The **Recommended IAM policies** column indicates whether the instance has an attached IAM role with the required permissions. We recommend attaching the service managed policy AWSEC2SqlHaInstancePolicy to the instance or you can use any equivalent custom inline policy. **Verified** indicates that the instance has the managed policy attached while it doesn't verify the permission if you use other custom policies. The **IAM role** column indicates the currently attached IAM role. To attach a different role, choose **Modify IAM role**.
1. Choose **Next**.
1. In the **Manage SQL High Availability license savings** step, for each instance do the following:
+ For **SQL High Availability license savings**, select **Enable**.
+ (*Optional*) For **SQL Server credentials**, select the secret that has the SQL Server credentials for that instance .
1. Choose **Next**.
1. In the **Review and apply changes** step, review the configuration and then choose **Apply changes**.
------
#### [ AWS CLI ]
Use the [ enable-instance-sql-ha-standby-detections](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-instance-sql-ha-standby-detections.html) command. For `instance-ids` specify the IDs of the instances to opt in. If you choose to perform Step 3: Create secret for SQL Server credentials, specify the optional `--sql-server-credentials` with the Amazon Web Services secret arn that has the SQL Server credentials in.
```
aws ec2 enable-instance-sql-ha-standby-detections \
--instance-ids instance_ids \
--sql-server-credentials secret_manager_secret_arn
```
------
# Windows user setup for Amazon EC2 High Availability for SQL Server
**Note**
You only need to perform the steps in this section if you choose to use the default, built-in `[NT AUTHORITY\SYSTEM]` user as described in [ Step 3: Store SQL Server credentials in AWS Secrets Manager](sql-high-availability-get-started.md#sql-high-availability-secret). If you choose to store custom SQL Server credentials in AWS Secrets Manager, these Windows user setup steps are not required.
Amazon EC2 High Availability for SQL Server uses AWS Systems Manager (SSM) to connect to Amazon EC2 instances and obtain SQL Server High Availability metadata. The SSM command runs under the context of the default local user on the Amazon EC2 instance: `NT AUTHORITY\SYSTEM`. If you performed post-launch lockdowns on your SQL Server instances by removing certain default SQL Server permissions and built-in groups, you may need to perform a few steps to grant required permissions to `NT AUTHORITY\SYSTEM`.
Additionally, when enabling your Amazon EC2 instances for SQL HA standby detection, you can optionally provide an AWS secret containing credentials to a Windows domain user or local user on your Amazon EC2 instances other than the default local user, `NT AUTHORITY\SYSTEM`. The service uses this provided Windows user to connect to all SQL Server instances on the Amazon EC2 instance and run SQL Server queries to obtain High Availability metadata. This guide explains how to either grant required permissions to `NT AUTHORITY\SYSTEM`, or how to create a Windows domain or local user with least permissions required for the service to process Amazon EC2 instances enabled for SQL HA standby detection, and how to create an AWS secret containing credentials for this user.
**Topics**
+ [Option 1: Grant required permissions to the [NT AUTHORITY\$1SYSTEM] user](#sql-ha-default-local-user)
+ [Option 2: Create new domain user with required permissions](#sql-ha-domain-user)
+ [Option 3: Create new local user with require permissions](#sql-ha-local-user)
## Option 1: Grant required permissions to the [NT AUTHORITY\$1SYSTEM] user
This section covers the most straightforward setup to begin enabling Amazon EC2 instances for SQL HA standby detection. If you follow this section, you need not provide an AWS secret when enabling your Amazon EC2 instances for SQL HA standby detection, since SSM will use the default local user `NT AUTHORITY\SYSTEM` to authenticate into SQL Server.
Since SQL Server license-included AMIs allow `NT AUTHORITY\SYSTEM` to authenticate into SQL Server by default, the following steps may not be required to enable your instances for SQL HA standby detection. However, if you performed post-launch lockdowns on your SQL Server instances, you may need to grant least permissions back to `NT AUTHORITY\SYSTEM` for the service to obtain High Availability metadata.
**To grant SQL Server access for NT AUTHORITY\$1SYSTEM**
The following steps need to be repeated on every SQL Server instance on the Amazon EC2 instance. Amazon EC2 SQL HA obtains High Availability metadata on all SQL Server installs on the Amazon EC2 instance, so the default local user needs to be able to query SQL Server across all SQL Server instances.
+ Connect to your Amazon EC2 instance and open SQL Server Management Studio, then run the following SQL Server command on each SQL Server instance. This command creates a SQL Server login for `NT AUTHORITY\SYSTEM` and grants minimal read-only SQL Server permissions for this user.
```
-- Create SQL Server login for default local user
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'NT AUTHORITY\SYSTEM')
BEGIN
CREATE LOGIN [NT AUTHORITY\SYSTEM] FROM WINDOWS WITH DEFAULT_DATABASE=[master]
END
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.sysusers WHERE name = 'NT AUTHORITY\SYSTEM')
BEGIN
CREATE USER [NT AUTHORITY\SYSTEM] FOR LOGIN [NT AUTHORITY\SYSTEM]
END
GO
-- Grant database permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.database_principals WHERE name = 'db_role_ec2_sql_ha')
BEGIN
CREATE ROLE [db_role_ec2_sql_ha]
END
GRANT VIEW DATABASE STATE to [db_role_ec2_sql_ha]
GO
ALTER ROLE [db_role_ec2_sql_ha] ADD MEMBER [NT AUTHORITY\SYSTEM]
GO
-- Grant server permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'svr_role_ec2_sql_ha')
BEGIN
CREATE SERVER ROLE [svr_role_ec2_sql_ha]
END
GRANT VIEW SERVER STATE TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DEFINITION TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DATABASE TO [svr_role_ec2_sql_ha]
GO
ALTER SERVER ROLE [svr_role_ec2_sql_ha] ADD MEMBER [NT AUTHORITY\SYSTEM]
GO
```
Your default local user setup is complete. You can now enable SQL HA standby detection for your Amazon EC2 instances.
## Option 2: Create new domain user with required permissions
This section covers how to create a Windows domain user with the necessary permissions to connect to SQL Server and obtain High Availability metadata. This option is preferred over creating a new local user, as the domain user can be used for any Amazon EC2 instance joined to the domain. This allows you to supply just one AWS secret for multiple Amazon EC2 instances enabled for SQL HA standby detection.
**To create and configure a domain user**
1. **Create a domain user**
This step differs based on the type of Active Directory (AD) being used, and assumes the Amazon EC2 instances you wish to enable for SQL HA standby detection are already joined to this domain. For an AWS managed Microsoft AD, use the following AWS AWS CLI commands to create a new domain user. Replace *username* and *password* with your desired username and password.
```
aws ds-data create-user \
--directory-id directory-id \
--sam-account-name "username"
```
Then assign a password to the domain user:
```
aws ds reset-user-password \
--directory-id directory-id \
--user-name "username" \
--new-password "password"
```
1. **Create an AWS secret containing credentials**
Save the Windows domain user credentials to an AWS secret. The domain user's username must be saved in the following format: `directory-netBIOS-name\username`. The *directory-netBIOS-name* is the directory NetBIOS name of your AD.
```
aws secretsmanager create-secret \
--name "domain-user-credentials" \
--description "Domain user credentials for EC2 SQL HA standby detection." \
--secret-string "{\"username\":\"directory-netBIOS-name\\username\",\"password\":\"password\"}"
```
1. **Grant SQL Server access for domain user**
Connect to your Amazon EC2 instance and open SQL Server Management Studio, then run the following SQL Server command on each SQL Server instance. Replace *username* with the username you selected and *directory-netBIOS-name* with the AD's directory NetBIOS name.
```
-- Create SQL Server login for domain user
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'directory-netBIOS-name\username')
BEGIN
CREATE LOGIN [directory-netBIOS-name\username] FROM WINDOWS WITH DEFAULT_DATABASE=[master]
END
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.sysusers WHERE name = 'directory-netBIOS-name\username')
BEGIN
CREATE USER [directory-netBIOS-name\username] FOR LOGIN [directory-netBIOS-name\username]
END
GO
-- Grant database permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.database_principals WHERE name = 'db_role_ec2_sql_ha')
BEGIN
CREATE ROLE [db_role_ec2_sql_ha]
END
GRANT VIEW DATABASE STATE to [db_role_ec2_sql_ha]
GO
ALTER ROLE [db_role_ec2_sql_ha] ADD MEMBER [directory-netBIOS-name\username]
GO
-- Grant server permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'svr_role_ec2_sql_ha')
BEGIN
CREATE SERVER ROLE [svr_role_ec2_sql_ha]
END
GRANT VIEW SERVER STATE TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DEFINITION TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DATABASE TO [svr_role_ec2_sql_ha]
GO
ALTER SERVER ROLE [svr_role_ec2_sql_ha] ADD MEMBER [directory-netBIOS-name\username]
GO
```
Your domain user setup is complete. When enabling Amazon EC2 instances for SQL HA standby detection, you can supply the ARN for the AWS secret you created.
## Option 3: Create new local user with require permissions
This section covers how to create a Windows local user restricted to a single Amazon EC2 instance with the necessary permissions to connect to SQL Server and obtain High Availability metadata.
**To create and configure a local user**
1. **Create a local user on the Amazon EC2 instance**
Connect to your Amazon EC2 instance and open PowerShell as Administrator, then execute the following command. Replace *username* and *password* with your desired username and password.
```
New-LocalUser -Name "username" -Password (ConvertTo-SecureString "password" -AsPlainText -Force) -Description "Local user for EC2 SQL HA standby detection."
```
1. **Create an AWS secret containing credentials**
Save the Windows local user credentials to an AWS secret.
```
aws secretsmanager create-secret \
--name "local-user-credentials" \
--description "Local user credentials for EC2 SQL HA standby detection." \
--secret-string "{\"username\":\"username\",\"password\":\"password\"}"
```
1. **Grant SQL Server access for local user**
Connect to your Amazon EC2 instance and open SQL Server Management Studio, then run the following SQL Server command on each SQL Server instance. Replace *username* with the username you selected and *COMPUTERNAME* with the Amazon EC2 instance computer name. You can retrieve the computer name with the PowerShell command `$env:COMPUTERNAME`.
```
-- Create SQL Server login for local user
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'COMPUTERNAME\username')
BEGIN
CREATE LOGIN [COMPUTERNAME\username] FROM WINDOWS WITH DEFAULT_DATABASE=[master]
END
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.sysusers WHERE name = 'COMPUTERNAME\username')
BEGIN
CREATE USER [COMPUTERNAME\username] FOR LOGIN [COMPUTERNAME\username]
END
GO
-- Grant database permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.database_principals WHERE name = 'db_role_ec2_sql_ha')
BEGIN
CREATE ROLE [db_role_ec2_sql_ha]
END
GRANT VIEW DATABASE STATE to [db_role_ec2_sql_ha]
GO
ALTER ROLE [db_role_ec2_sql_ha] ADD MEMBER [COMPUTERNAME\username]
GO
-- Grant server permissions
USE [master]
GO
IF NOT EXISTS (SELECT name FROM master.sys.server_principals WHERE name = 'svr_role_ec2_sql_ha')
BEGIN
CREATE SERVER ROLE [svr_role_ec2_sql_ha]
END
GRANT VIEW SERVER STATE TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DEFINITION TO [svr_role_ec2_sql_ha]
GRANT VIEW ANY DATABASE TO [svr_role_ec2_sql_ha]
GO
ALTER SERVER ROLE [svr_role_ec2_sql_ha] ADD MEMBER [COMPUTERNAME\username]
GO
```
Your local user setup is complete. When enabling Amazon EC2 instances for SQL HA standby detection, you can supply the ARN for the AWS secret you created.
# Disable Amazon EC2 High Availability for SQL Server
You can disable Amazon EC2 High Availability for SQL Server (SQL HA). Note only instances enabled by SQL HA can receive the SQL Server license savings. Use one of the following methods to disable SQL HA for your instances:
------
#### [ Console ]
1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/).
1. In the navigation panel, choose **Instances**.
1. Select the instances in the High Availability deployment to enable SQL HA standby detection monitoring, choose **Actions**, **Instance settings**, **Modify SQL High Availability settings**.
1. In the **Review prerequisites** step, choose **Next**. The prerequisites only apply for enabling the monitoring, and it is not necessary to review them for disabling SQL HA standby detection monitoring.
1. In the **Manage SQL High Availability license savings** step, for each instance to disable, for **SQL High Availability license savings**, select **None**.
1. Choose **Next**.
1. In the **Review and apply changes** step, review the configuration and then choose **Apply changes**.
------
#### [ AWS CLI ]
Use the [ disable-instance-sql-ha-standby-detections](https://docs.aws.amazon.com/cli/latest/reference/ec2/disable-instance-sql-ha-standby-detections.html) command. For `instance-ids`, specify the IDs of the instances to disable.
```
aws ec2 disable-instance-sql-ha-standby-detections \
--instance-ids instance_ids
```
------
# View states for Amazon EC2 High Availability for SQL Server
You can view the Amazon EC2 High Availability for SQL Server (SQL HA) current and historical states. Use one of the following methods:
------
#### [ Console ]
1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/).
1. In the navigation panel, choose **Instances**.
1. Select the instances in the High Availability deployment for which to view the SQL HA states, then choose the **SQL High Availability** tab.
------
#### [ AWS CLI ]
To view the current SQL HA states for Amazon EC2 instances, use the [describe-instance-sql-ha-states](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-sql-ha-states.html) command. This command only shows the current SQL HA status of your onboarded instances.
```
aws ec2 describe-instance-sql-ha-states \
--instance-ids instance_ids
```
To view the historical SQL HA states for instances, use the [ describe-instance-sql-ha-history-states](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-sql-ha-history-states.html) command. This command returns your SQL HA instance state transitions in descending time order.
```
aws ec2 describe-instance-sql-ha-history-states \
--instance-ids instance_ids \
--start-time period_start_timestamp \
--end-time period_end_timestamp
```
------