AWS AmazonRDS documentation change
Summary
Replaced text notes with a detailed comparison table showing replication behavior for server-level objects in different Multi-AZ deployments (Database Mirroring/Always On AGs vs block-level replication)
Security assessment
The change clarifies replication behavior but doesn't address any specific vulnerability. It documents existing replication limitations (e.g., msdb permissions not replicating in DBM/AGs), which could impact access control during failovers, but doesn't introduce new security fixes.
Diff
diff --git a/AmazonRDS/latest/UserGuide/USER_SQLServerMultiAZ.Recommendations.md b/AmazonRDS/latest/UserGuide/USER_SQLServerMultiAZ.Recommendations.md index 4353e467c..0118aa061 100644 --- a//AmazonRDS/latest/UserGuide/USER_SQLServerMultiAZ.Recommendations.md +++ b//AmazonRDS/latest/UserGuide/USER_SQLServerMultiAZ.Recommendations.md @@ -33,2 +32,0 @@ If you need a higher limit, request an increase by contacting Support. Open the - * RDS for SQL Server doesn't replicate MSDB database permissions to the secondary instance. If you need these permissions on the secondary instance, you must recreate them manually. - @@ -54,2 +51,0 @@ The following are some notes about working with Multi-AZ deployments on RDS for - * Users, logins, and permissions are automatically replicated for you on the secondary. You don't need to recreate them. User-defined server roles are replicated in DB instances that use Always On AGs or block level replication for Multi-AZ deployments. - @@ -60,2 +55,0 @@ The following are some notes about working with Multi-AZ deployments on RDS for - * In Multi-AZ deployments, SQL Server Agent jobs are replicated from the primary host to the secondary host when the job replication feature is turned on. For more information, see [Turning on SQL Server Agent job replication](./Appendix.SQLServer.CommonDBATasks.Agent.html#SQLServerAgent.Replicate). - @@ -70,0 +65,33 @@ The following are some notes about working with Multi-AZ deployments on RDS for +The following table compares how server-level objects are replicated in RDS for SQL Server Multi-AZ deployments using Database Mirroring (DBM) or Always On Availability Groups (AGs) versus block-level replication. + +Replication behavior by object type Object | Database Mirroring / Always On AGs | Block-level replication +---|---|--- +Logins | Yes — replicated by Amazon RDS. The `DEFAULT_DATABASE` property is _not_ replicated. Don't use `DEFAULT_DATABASE` when creating or altering logins on DBM or Always On AG instances. | Yes — including `DEFAULT_DATABASE` (no restriction). +Database users and permissions | Yes — replicated through SQL Server native replication (stored in user databases). | Yes. +User-defined server roles | Always On AGs: Yes — replicated. DBM: No — not replicated. | Yes. +Linked servers | No — stored in the `master` database, which is outside the AG or mirror. Create linked servers before enabling Multi-AZ, or recreate them manually after failover. | Yes — the entire volume, including system databases, is replicated. +SQL Server Audit | Partial — Database Audit Specifications (in user databases) are replicated. Server Audits and Server Audit Specifications are _not_ replicated. You must create these manually on the secondary using the `AUDIT_GUID` parameter to match the primary. | Yes — all audit objects are replicated at the volume level. +`tempdb` configuration | Optional — enable synchronization with the following stored procedure. + + + EXECUTE msdb.dbo.rds_set_system_database_sync_objects + @object_types = 'TempDbFile'; + +Temporary objects and data are never replicated. | Yes — configuration is replicated at the volume level. +SQL Server Agent jobs | Optional — enable synchronization with the following stored procedure. + + + EXECUTE msdb.dbo.rds_set_system_database_sync_objects + @object_types = 'SQLAgentJob'; + +Only T-SQL job steps in supported categories are replicated. SSIS, SSRS, Replication, PowerShell, and Database Mail step types are _not_ replicated. | Yes — all jobs are replicated at the volume level. +CDC (Change Data Capture) | Partial — CDC metadata and change tables (in user databases) are replicated. Capture and cleanup jobs (in `msdb`) are _not_ directly replicated. Amazon RDS drops and recreates them on the new primary after failover using previously recorded parameters. Use `rds_set_configuration` to preset CDC parameters on the secondary. | Yes — all CDC objects are replicated at the volume level. +Resource Governor | Yes — replicated by Amazon RDS. To verify synchronization, run the following query. + + + SELECT * FROM msdb.dbo.rds_fn_server_object_last_sync_time(); + +| Yes. +Database owner | No — on the secondary instance, the database owner is set to `NT AUTHORITY\SYSTEM`. After failover, use `msdb.dbo.rds_changedbowner_to_rdsa` to reset ownership. | Yes — owner is preserved. +`msdb` permissions | No — RDS for SQL Server doesn't replicate `msdb` database permissions to the secondary instance. You must recreate them manually. | Yes — replicated at the volume level. +