Deployment guide

SQL Server 2022 Express

Microsoft SQL Server 2022 Express is the free entry-level edition of SQL Server — the full T-SQL engine, capped at 1 CPU socket (4 cores), 1.4 GB RAM, and 10 GB per database. Use it for development, learning, small production workloads, and evaluating SQL Server features before upgrading to a paid edition.

Edition limits: 1 socket / 4 cores · 1.4 GB RAM · 10 GB max database size

License: Free for commercial use — no product key or SPLA agreement required

SQL Server version: 2022 (RTM-CU24-GDR) 16.0.4250.1

1. Deploy the VM

In the Azure portal, launch the SQL Server 2022 Express on Ubuntu 22.04 LTS by SecureAnyCloud image from the Azure Marketplace.

Recommended VM size: Standard_D2s_v3 (2 vCPU / 8 GB RAM). Express caps memory at 1.4 GB regardless of VM size. D2s_v3 gives comfortable headroom for the OS and any co-located services.

Networking: Open inbound port 1433 (SQL Server TDS) in your network security group. Restrict the source to trusted IP ranges, and do not open 1433 to the public internet.

After the VM starts, connect over SSH:

ssh azureuser@<your-vm-public-ip>

2. Retrieve the credentials

On first boot, a systemd service generates a unique SA password and a secondary SecureAnyCloud login. It writes both to a credentials file. Read the file:

sudo cat /stage/scripts/mssql-credentials.log

Example output:

# SQL Server 2022 Express Edition — Per-VM Credentials
# Generated: Fri Apr 24 22:35:01 UTC 2026
#
# Express Edition is free for commercial use within the edition limits:
# 1 CPU socket / 4 cores | 1.4 GB RAM | 10 GB max database size
# No license key required.
# SA_USER=sa SA_PASSWORD=Az<generated> SAC_USER=sac SAC_PASSWORD=Cl<generated> SAC_DATABASE=sac

Save the SA_PASSWORD value. You will use it for the initial connection.

3. Verify the service

sudo systemctl status mssql-server --no-pager

The service should show active (running). If it is not running yet, first boot may still be completing. Wait 30 seconds and retry.

Check that port 1433 is listening:

ss -tlnp | grep 1433

4. Connect with sqlcmd from the VM

sqlcmd (version 18) is preinstalled. Read your SA password and verify the SQL Server version:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /stage/scripts/mssql-credentials.log | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "${SA_PASS}" -C -Q "SELECT @@VERSION" -h -1 -W

The output looks like this:

Microsoft SQL Server 2022 (RTM-CU24-GDR) (KB5083252) - 16.0.4250.1 (X64) Mar 13 2026 00:15:17 Copyright (C) 2022 Microsoft Corporation Express Edition (64-bit) on Linux (Ubuntu 22.04.5 LTS) <X64>

Confirm the edition:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /stage/scripts/mssql-credentials.log | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "${SA_PASS}" -C -Q "SELECT SERVERPROPERTY('Edition')" -h -1 -W

5. Connect from your workstation

sqlcmd on Linux or macOS (install it from aka.ms/get-sqlcmd):

sqlcmd -S <your-vm-public-ip>,1433 -U sa -P '<SA_PASSWORD>' -C

Azure Data Studio: download it from aka.ms/azuredatastudio, then create a new connection with these settings:

Server: <your-vm-public-ip>,1433
Authentication: SQL Login
Username: sa
Password: <SA_PASSWORD>
Trust server certificate: enabled

SSMS on Windows: use the same connection string. Express supports all SQL Server Management Studio features for a database of this size.

6. Create a database and table

Connect to the instance and run:

-- Create a database CREATE DATABASE myapp; GO -- Use it USE myapp; GO -- Create a table CREATE TABLE customers ( id INT IDENTITY(1,1) PRIMARY KEY, name NVARCHAR(100) NOT NULL, email NVARCHAR(255) UNIQUE, created_at DATETIME2 DEFAULT SYSDATETIME() ); GO -- Insert a row INSERT INTO customers (name, email) VALUES (N'Alice', N'alice@example.com'); GO -- Query SELECT * FROM customers; GO

Express limit: Each database is capped at 10 GB. When a database reaches the limit, SQL Server logs error 1105 and rejects inserts that would exceed it.

7. Create an application login

Do not use sa for day-to-day application access. Create a least-privilege login:

-- Create login CREATE LOGIN appuser WITH PASSWORD = 'StrongP@ssw0rd!'; GO -- Grant access to your database USE myapp; CREATE USER appuser FOR LOGIN appuser; ALTER ROLE db_datareader ADD MEMBER appuser; ALTER ROLE db_datawriter ADD MEMBER appuser; GO

8. Configure TLS encryption

By default, the server accepts unencrypted connections. Enable forced encryption in two parts.

First, generate a self-signed certificate (or use a CA-signed certificate):

sudo openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \
  -keyout /etc/ssl/private/mssql.key \
  -out /etc/ssl/certs/mssql.pem \
  -subj "/CN=$(hostname -f)" sudo chown mssql:mssql /etc/ssl/private/mssql.key /etc/ssl/certs/mssql.pem
sudo chmod 600 /etc/ssl/private/mssql.key

Second, configure SQL Server to use the certificate:

sudo /opt/mssql/bin/mssql-conf set network.tlscert /etc/ssl/certs/mssql.pem
sudo /opt/mssql/bin/mssql-conf set network.tlskey /etc/ssl/private/mssql.key
sudo /opt/mssql/bin/mssql-conf set network.forceencryption 1
sudo systemctl restart mssql-server

After the restart, clients must connect with TLS. Once you have a CA-signed certificate, remove -C (trust self-signed) and add -N (encrypt).

9. Back up a database

SQL Server Express supports the full BACKUP DATABASE syntax. Create the backup directory and run a backup:

sudo mkdir -p /var/opt/mssql/backups
sudo chown mssql:mssql /var/opt/mssql/backups

From sqlcmd:

BACKUP DATABASE myapp TO DISK = '/var/opt/mssql/backups/myapp.bak' WITH FORMAT, COMPRESSION, STATS = 10; GO

Schedule regular backups with a cron job or Azure Backup.

10. Security hardening

Rotate the SA password:

ALTER LOGIN [sa] WITH PASSWORD = 'NewStr0ng!Pass'; GO

Disable the SA login once you have application logins:

ALTER LOGIN [sa] DISABLE; GO

Network security group rules: Restrict port 1433 to specific source IP ranges. Never expose it to 0.0.0.0/0.

Check the current logins:

SA_PASS=$(sudo grep '^SA_PASSWORD=' /stage/scripts/mssql-credentials.log | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "${SA_PASS}" -C \
  -Q "SELECT name, is_disabled FROM sys.server_principals WHERE type='S'" -h -1 -W

Useful commands

Check service status:

sudo systemctl status mssql-server --no-pager

View the SQL Server error log:

sudo tail -50 /var/opt/mssql/log/errorlog

Check the memory configuration:

sudo /opt/mssql/bin/mssql-conf get memory memorylimitmb 2>/dev/null; echo "memory check done"

Restart SQL Server:

sudo systemctl restart mssql-server

Credentials file reference

/stage/scripts/mssql-credentials.log holds the SA password and the SecureAnyCloud login credentials (mode 600).

The first-boot service creates the SecureAnyCloud database and login. You can use them for initial application testing. Create application-specific logins as described in section 7.

Deploy on Azure

Launch SQL Server 2022 Express with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Microsoft SQL Server 2022 Express Edition, the free, entry-level edition for small databases, prototypes, learning and lightweight applications. SQL Server is the only workload on the image, so the platform stays lean and predictable. This guide covers the Express delivery option. SQL Server 2022 is also offered in other editions on the same listing. See the SQL Server 2022 on AWS hub to compare and choose.

What you get:

SQL Server installed from the official Microsoft APT repository, with the mssql-tools18 package and the sqlcmd command-line utility preinstalled
SQL Server data and log files on a dedicated gp3 EBS volume mounted at /var/opt/mssql, separate from the OS disk and independently resizable
A one-shot first-boot service that generates a fresh SA password, creates a dedicated SecureAnyCloud SQL login, removes the build-time memory cap and writes all credentials to /root/mssql-credentials.txt, a file only root can read
No shared or default credentials in the image
SQL Server listening on port 1433 and starting on boot via systemd
Express edition limits: a maximum database size of 10 GB, about 1.4 GB of buffer-pool memory, and 1 socket or 4 cores. Backup compression is not available on Express

This is a headless image. SQL Server has no web interface. You administer it over SSH with sqlcmd and any compatible SQL Server client on port 1433.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Recommended instance type: t3.large or m5.large (Express is lightweight).

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for SQL Server 2022. Select the SecureAnyCloud listing and choose Select. On the subscription summary, pick the SQL Server 2022 Express on Ubuntu 22.04 delivery option and choose Continue.

Pick an instance type that suits your workload (see Prerequisites). Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and a security group that allows inbound port 22 from your management network. Add port 1433 if you want external clients to connect to SQL Server directly. The AMI brings its own data volume, so leave the block device mappings at their defaults.

Select Launch instance. First-boot initialization generates the SA password and starts SQL Server. It takes a minute or two after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

Replace <ami-id> with the AMI ID shown on the Marketplace listing for the Express delivery option. Replace the network and key values with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mssql-01}]'

The data volume is defined in the AMI, so you do not need to specify it. Once the instance is running, retrieve its public address:

aws ec2 describe-instances --instance-ids <instance-id> \
  --query "Reservations[].Instances[].PublicIpAddress" --output text

Connect over SSH

This delivery option is built on Ubuntu 22.04, so the SSH login user is ubuntu:

ssh ubuntu@<your-instance-ip>

Wait until the instance has passed both EC2 status checks before connecting.

Retrieve the Generated SA Password

The first-boot service writes the per-instance credentials to /root/mssql-credentials.txt (root-only):

sudo cat /root/mssql-credentials.txt

The file looks like this, with unique passwords on your instance:

# SQL Server 2022 Express Edition -- Per-Instance Credentials
# Generated: Wed Jun 04 09:00:00 UTC 2026
# SA_USER=sa SA_PASSWORD=<set-at-first-boot> SAC_USER=sac SAC_PASSWORD=<set-at-first-boot> SAC_DATABASE=sac

The SecureAnyCloud login has db_owner on the SecureAnyCloud database and is suitable for application connections.

Connect to SQL Server with sqlcmd

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U sa -P "${SA_PASS}" -C

The -C flag trusts the self-signed server certificate. Type GO to run a batch, exit to quit.

Verify the Version and Edition

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U sa -P "${SA_PASS}" -C -Q "SELECT @@VERSION"

The output resembles the following. The edition line reflects this image's Express edition.

Microsoft SQL Server 2022 (RTM-CU25) (KB5054531) - 16.0.4255.1 (X64) May 20 2026 12:06:45 Copyright (C) 2022 Microsoft Corporation Express Edition (64-bit) on Linux (Ubuntu 22.04.5 LTS) <X64>

Licensing

SQL Server Express Edition is a free edition and requires no product key. It is fully licensed for production use within its edition limits (see Overview).

Check the SQL Server Service

sudo systemctl status mssql-server --no-pager

Manage the service with sudo systemctl {stop,start,restart} mssql-server.

The Data Volume

SQL Server data and log files are stored on a dedicated gp3 EBS volume mounted at /var/opt/mssql, separate from the OS disk:

df -h /var/opt/mssql lsblk

To grow it, resize the EBS volume in the AWS console, then extend the filesystem on the instance:

sudo resize2fs $(findmnt -no SOURCE /var/opt/mssql)

Create a Database and Table

SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U sa -P "${SA_PASS}" -C -Q "IF DB_ID('myapp') IS NULL CREATE DATABASE [myapp];" /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U sa -P "${SA_PASS}" -C -d myapp -Q "IF OBJECT_ID('customers') IS NULL CREATE TABLE customers (id INT IDENTITY PRIMARY KEY, name NVARCHAR(100), email NVARCHAR(200)); INSERT INTO customers (name,email) VALUES ('Alice Smith','alice@example.com'); SELECT id,name,email FROM customers;"

Express edition: databases are capped at 10 GB, and backup compression is not available, so omit COMPRESSION. Choose Standard, Web or Enterprise for larger databases.

Connect from a Remote Client

SQL Server listens on port 1433. Add port 1433 to the security group, then connect with SSMS, Azure Data Studio, DBeaver or sqlcmd:

/opt/mssql-tools18/bin/sqlcmd -S <your-instance-ip>,1433 -U sa -P "<SA_PASSWORD>" -C

Backup and Restore

sudo mkdir -p /var/opt/mssql/backup && sudo chown mssql:mssql /var/opt/mssql/backup
SA_PASS=$(sudo grep '^SA_PASSWORD=' /root/mssql-credentials.txt | cut -d= -f2-) /opt/mssql-tools18/bin/sqlcmd -S 127.0.0.1 -U sa -P "${SA_PASS}" -C -Q \
  "BACKUP DATABASE [sac] TO DISK = N'/var/opt/mssql/backup/sac.bak' WITH INIT;"

Troubleshooting

Will not start: sudo cat /var/opt/mssql/log/errorlog | tail -50 and sudo journalctl -u mssql-server -n 50 --no-pager.
Port 1433 unreachable: check the security group inbound rules.
Credentials permission denied: the file is root-only, so use sudo.
First-boot did not run: sudo journalctl -u mssql-firstboot -n 50 --no-pager and sudo cat /var/log/mssql-firstboot.log.

SecureAnyCloud Support

This image is supported by SecureAnyCloud. For assistance with SQL Server deployment, configuration, performance tuning, high availability or administration, contact sales@secureanycloud.com. Support is available 24 hours a day, 7 days a week.

Deploy on AWS

Launch SQL Server 2022 Express on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS