SecureAnyCloud
Deployment guide

SQL Server 2019 Enterprise

Overview

This guide covers deploying and configuring SQL Server 2019 Enterprise on Linux, using SecureAnyCloud AMIs from AWS Marketplace.

SQL Server 2019 Enterprise edition delivers the full set of SQL Server capabilities, including mission-critical performance, advanced security features and comprehensive high availability for the most demanding database workloads.

What you get:

  • SQL Server 2019 Enterprise edition installed at /opt/mssql
  • SQL Server database port 1433, preconfigured and listening on boot
  • An SA (System Administrator) account with a randomly generated password
  • The sqlcmd command-line tool for database interaction
  • An OS package update script for keeping the system current
  • AWS CLI v2 for AWS service integration
  • The Systems Manager Agent (SSM) for remote management
  • The CloudWatch Agent for monitoring
  • The latest security patches, applied at build time
  • 24/7 SecureAnyCloud support with a guaranteed 24 hour response SLA

Edition notes: SQL Server 2019 Enterprise is designed for mission-critical production workloads. It includes all SQL Server features with no limits on compute capacity or database size.

Key Enterprise-exclusive features include Always On availability groups, in-memory OLTP, columnstore indexes, advanced analytics with R and Python, data virtualization with PolyBase, and transparent data encryption. A valid Microsoft SQL Server Enterprise licence is required.

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account
  • An active subscription to the SQL Server 2019 Enterprise listing on AWS Marketplace
  • An EC2 key pair for SSH access
  • Familiarity with EC2 instance management and SSH
  • A valid SQL Server 2019 Enterprise licence (if not included via Marketplace BYOL)

Recommended instance type: r5.xlarge (4 vCPU, 32 GB RAM) or larger. Enterprise workloads benefit significantly from memory-optimized instances for caching, in-memory OLTP and columnstore performance.

Minimum requirements: 1 vCPU, 2 GB RAM and 6 GB disk space. Production deployments should provision substantially more resources.

1

Launch the AMI

  • Open AWS Marketplace and search for "SQL Server 2019 Enterprise SecureAnyCloud".
  • Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Choose Continue to Launch.
  • Choose Launch through EC2 for full control over instance configuration.
  • Select your instance type (r5.xlarge is recommended for production).
  • Configure storage. Provision sufficient gp3 or io2 volumes for your database workloads. Consider separate EBS volumes for data, log and tempdb files for optimal I/O performance.
  • Configure your Security Group with the inbound rules below.
  • Select your EC2 key pair and launch the instance.

Security group inbound rules:

Port 22, TCP, from your IP: SSH access.

Port 1433, TCP, from your IP: the SQL Server database port.

Important: Restrict port 1433 to trusted application servers or your IP only. Never expose the SQL Server port to the public internet. For Always On availability groups, also allow port 5022 between cluster nodes.

2

Connect via SSH

Once your instance is running and has passed both status checks (2/2), connect over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user:

sudo su -

Important: Wait for the EC2 instance to reach 2/2 successful status checks before connecting. Early connection attempts may produce "Permission denied" errors while the instance is still initializing.

3

Retrieve the SA Password

The SA (System Administrator) password is randomly generated at build time and stored in a log file on the instance. Retrieve it by running:

cat /stage/scripts/mssql_admin_password.log

Save this password securely. You need it to connect to SQL Server.

4

Connect to SQL Server

Use the sqlcmd command-line tool to connect to the local SQL Server instance:

sqlcmd -S localhost -U SA

When prompted, enter the SA password that you retrieved in Step 3. The expected output is:

1>

You are connected to SQL Server and can run T-SQL queries.

5

Create a Database and Table

Create a new database:

CREATE DATABASE MyAppDB; GO

Switch to the new database:

USE MyAppDB; GO

Create a table:

CREATE TABLE Users ( UserID INT IDENTITY(1,1) PRIMARY KEY, Name NVARCHAR(100), Email NVARCHAR(255), CreatedAt DATETIME DEFAULT GETDATE() ); GO

Insert data:

INSERT INTO Users (Name, Email) VALUES ('John Doe', 'john@example.com'); GO

Query data:

SELECT * FROM Users; GO

Type QUIT to exit the sqlcmd shell.

Server Components

The image contains SQL Server 2019 Enterprise, installed at /opt/mssql.

Note: The automatic OS package update script can update component versions on first boot when it finds newer versions in the system package repositories.

Filesystem Layout

The instance has these mount points:

/: 38 GB, the root filesystem.

/boot: 2 GB, the operating system kernel files.

/opt/mssql: 9.8 GB, the SQL Server installation directory.

Managing the SQL Server Service

systemd manages SQL Server, and it starts automatically on boot.

Check service status:

systemctl status mssql-server

Stop SQL Server:

systemctl stop mssql-server

Start SQL Server:

systemctl start mssql-server

Restart SQL Server:

systemctl restart mssql-server

Scripts and Log Files

These files live in /stage/scripts:

initial_boot_update.sh: updates the OS with the latest packages on first boot.

initial_boot_update.log: the output log for the boot update script.

mssql_admin_password.log: contains the randomly generated SA password.

On Startup

An OS package update script runs on first boot to bring the image fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Cannot connect via SSH

  • Wait for the EC2 instance to reach 2/2 status checks
  • Verify your security group allows port 22 from your IP
  • Confirm you are using the correct key pair and connecting as ec2-user
  • Check the instance system log in the AWS Console for boot errors

SQL Server service not running

  • Check service status: systemctl status mssql-server
  • Review the SQL Server error log: cat /var/opt/mssql/log/errorlog
  • Verify sufficient disk space: df -h /opt/mssql
  • Ensure the instance has at least 2 GB RAM

Cannot connect to SQL Server on port 1433

  • Verify the service is running: systemctl status mssql-server
  • Check the security group allows port 1433 from your IP
  • Test local connectivity: sqlcmd -S localhost -U SA
  • Check SQL Server is listening: ss -tlnp | grep 1433

SA password not working

  • Retrieve the password again: cat /stage/scripts/mssql_admin_password.log
  • Ensure you are copying the entire password without extra whitespace
  • If needed, reset the SA password using mssql-conf:
sudo systemctl stop mssql-server
sudo /opt/mssql/bin/mssql-conf set-sa-password
sudo systemctl start mssql-server

High memory usage

  • SQL Server Enterprise is designed to use all available memory for caching and in-memory features
  • Configure memory limits with mssql-conf:
sudo /opt/mssql/bin/mssql-conf set memory.memorylimitmb 4096
sudo systemctl restart mssql-server
  • For Enterprise workloads, consider memory-optimized instance types (r5, r6i) to provide adequate resources

Security Recommendations

  • Restrict port access: Only allow SQL Server port 1433 from trusted application servers or specific IP addresses
  • Change the SA password: After first login, replace the generated password with a strong, unique password
  • Create application-specific logins: Avoid using the SA account for application connections. Create dedicated logins with minimal required permissions
  • Enable Transparent Data Encryption (TDE): Enterprise edition supports TDE to encrypt data at rest
  • Enable encrypted connections: Configure SQL Server to use TLS/SSL for client connections
  • Enable auditing: Use SQL Server Audit (Enterprise feature) to track database access and changes
  • Keep SQL Server updated: Apply cumulative updates and security patches when available
  • Monitor access: Review the SQL Server error logs regularly for failed login attempts
  • Use AWS security features: Leverage VPC security groups, NACLs, and private subnets to restrict network access
  • Secure the password file: After retrieving the SA password, consider removing or restricting access to /stage/scripts/mssql_admin_password.log
  • Configure Always On: For high availability, set up Always On availability groups across multiple instances

Support

If you run into any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on AWS

Launch SQL Server 2019 Enterprise with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com