SQL Server in AWS on Linux The gotchas, the pain, and the resolution. It’s easier than you’d think.

Who am I? Stacy Hein 20 years IT experience 17 years of SQL Server experience Version 6.5 through now Worked in most industries and sizes of companies Consulting experience with several companies Worked as an Senior Escalation Engineer for the SharePoint 365 Team at Microsoft Masters of Science Cybersecurity from Excelsior College http://www.excelsior.edu DCS – Cybersecurity and Information Assurance (Student) http://www.ctuonline.com 2 | 9/19/2018 | Footer Goes Here

Background Skills Know something about Linux PowerShell or bust Pluralsight – Linux Server Skills for Windows Administrators https://www.pluralsight.com/courses/linux-server-skills-windows-administratorsClouds skills becoming a must PowerShell or bust PowerShell is open source now, can install on Linux https://4sysops.com/archives/install-powershell-on-ubuntu-16-04/ SQL Server Command-Line

Background Skills Information from Amazon on EC2 instances https://aws.amazon.com/documentation/ec2/ General AWS Information https://aws.amazon.com/documentation/ Security basics DON’T do everything from root. Create separate accounts for the systems admins and SQL admins When setting up server and security, consider that AWS uses deny all setting by default Setup VPCs for the servers In larger organizations, this is done by the network admins

Security Basics – Shared Responsibility Model Amazon Web Services. (2017). Amazon Shared Responsibility Model. Retrieved from https://aws.amazon.com/compliance/shared-responsibility-model/

Security Basics – Shared Responsibility Model AWS Shared Responsibility Model AWS provides secure infrastructure and services Customer is responsible for secure operating systems, platforms, and data

Security Basics – Shared Responsibility Model Bottom line is that they provide secure infrastructure, container services, and abstracted services. You’re responsible for everything else.

Security Basics – Shared Responsibility Model Infrastructure Services EC2 – Elastic Compute Cloud EBS – Elastic Block Store Auto-Scaling VPC –Virtual Private Clouds

Security Basics – Shared Responsibility Model Container Services Elastic Beanstalk (Application deployment) https://aws.amazon.com/elasticbeanstalk/ Elastic Map Reduce (big data or is it BIG DATA?) https://aws.amazon.com/emr/ Uses Hadoop Amazon RDS (Relational Database Services) https://aws.amazon.com/rds/ Six flavors (Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle, and Microsoft SQL Server)

Security Basics – Shared Responsibility Model Abstracted Services Database (static or static-ish), high-level storage, and messaging Glacier (Archival) https://aws.amazon.com/glacier/ S3 (Simple Storage Service) object storage with a simple web service interface DynamoDB (NoSQL option in AWS) https://aws.amazon.com/dynamodb/ NoSQL solution (fast retrieval)

Security Basics – Shared Responsibility Model Simple Queueing Service (SQS) https://aws.amazon.com/sqs/ Manage queueing between individual components of code or services Simple Email Service (SES) https://aws.amazon.com/ses/

Security Basics – Shared Responsibility Model IAM – Identity and Access Management – feature used by you to enhance security provided by AWS IAM planning, maintenance, and overall governance is important to your organization Some helpful features There are pre-defined roles but you can create your own (Ex. DatabaseAdministrator)

Security Basics – Shared Responsibility Model You can make permissions as granular as needed for your organization Ex. DBAs aren’t creating VPCs or limit access to your instances as you would with SQL Allows you to separate duties as needed in your organization for compliance Can be used for compliance when combined with other services (e.g. Cloud Trail Services) https://aws.amazon.com/cloudtrail/ Logging, monitoring, and auditing

Initial Info Used to set EBS drives up ahead of time Don’t need to do that anymore. You can set them up during the server setup process. Need at least 3.25GB of memory to run Only been tested up to 256GB This is above the AWS and Azure free tiers. But you can still set them up, you just pay for the running time and data movement.

Initial Info Configuration Items Are you going to setup HADR? Disk Setup Memory Processor Affinity Are you going to setup HADR? MS is trying to get all the HADR options for SQL on Windows ported to Linux, most are not there yet Options Simple HADR VM Failover

Initial Info - HADR Options Simple HADR VM failover Resilience against guest and OS level failures Unplanned and planned events Minimum downtime for patching and upgrades RTO in minutes Backup/Restore Protection against accidental or malicious data corruption Disaster recovery protection RTO in minutes to hours Standard HADR Failover cluster Linux (HeartBeat, LinuxHA, etc) Instance level protection Automatic failure detection and failover Resilience against OS and SQL Server failures RTO in seconds to minutes

Initial Info - HADR Options Standard HADR continued Log shipping Simple disaster-recovery solution for a single primary database and one or more secondary databases, each on a separate instance of SQL Server. Supports limited read-only access to secondary databases (during the interval between restore jobs). Allows a user-specified delay between when the primary server backs up the log of the primary database and when the secondary servers must restore (apply) the log backup. A longer delay can be useful, for example, if data is accidentally changed on the primary database. If the accidental change is noticed quickly, a delay can let you retrieve still unchanged data from a secondary database before the change is reflected there. Basic availability groups – 2 nodes (in progress) Synchronous or asynchronous mode RTO in seconds Disaster recovery protection Resilience against guest and OS level failures Unplanned and planned events Minimum downtime for patching and upgrades

Initial Info - HADR Options Mission-critical HADR (in progress) Availability groups with several nodes

Initial Info - Security Options Always Encrypted Always Encrypted is a feature designed to protect sensitive data Allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine Row-Level Security Row-Level Security enables customers to control access to rows in a database table based on the characteristics of the user executing a query Dynamic Data Masking Dynamic data masking limits (DDM) sensitive data exposure by masking it to non-privileged users. It can be used to greatly simplify the design and coding of security in your application.

Configuring the Instance After Install mssql-conf is a configuration script that installs with SQL Server vNext CTP 2.1 for both Red Hat Enterprise Linux and Ubuntu. Can use utility to set the following parameters: TCP port Default data directory Default log directory Default dump directory Default backup directory Set traceflags Set collation

Installing the SQL Tools Done separately from instance install Installs command-line tools Microsoft ODBC drivers their dependencies Mssql-tools package contains: sqlcmd: Command-line query utility bcp: Bulk import-export utility

Setting up Ubuntu in AWS DEMO

Setting up Ubuntu in AWS These procedures and tools are changing almost daily!!! Visit these sites: Install SQL on Linux- https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-ubuntu Install SQL Tools - https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools#ubuntu SQL Management Studio for Windows - https://docs.microsoft.com/en-us/sql/ssms/sql-server-management-studio-ssms-release-candidate Connecting to SQL Server with Putty - http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/putty.html

Questions?

Thank You No, THANK YOU!

References and Additional Information Install SQL on Ubuntu https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-ubuntu Install SQL on Redhat https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-red-hat Install SQL Tools https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools Install SQL Server Management Studio With Linux Support https://msdn.microsoft.com/en-us/library/mt238290.aspx SQL Server on Linux: High availability and security https://blogs.technet.microsoft.com/dataplatforminsider/2016/11/30/sql-server-on-linux-high-availability-and-security/

References and Additional Information SQL Security on Linux https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-security-get-started Configuring SQL Server on Linux https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-configure-mssql-conf Microsoft Information on Linux https://docs.microsoft.com/en-us/sql/linux/ AWS Documentation https://aws.amazon.com/documentation/ec2/ Linux for Windows Admins (Pluralsight) https://www.pluralsight.com/courses/linux-server-skills-windows-administrators