How do I manage option groups for Amazon RDS SQL Server instances?

Resolution

Remove persistent options

To remove persistent options, such as transparent data encryption (TDE), complete the following steps:

1. Turn off TDE for RDS for SQL Server.
2. Open the Amazon Aurora and RDS console.
3. In the navigation pane, choose Option groups.
4. Select your option group.
5. Remove all associated RDS database (DB) instances from the option group. 
   Note: If you associated DB instances with the group, then you can't remove persistent options from an option group.
6. Create a new option group without the persistent option.
7. Associate the new option group with your DB instances. For Option group, select the new option group.

Add options to the option group 

Complete the following steps:

1. Open the Aurora and RDS console.
2. In the navigation pane, choose Option groups.
3. Create a new option group.
4. Add options and configure their settings.
5. Associate the custom option group with your DB instances. For Option group, select the new option group.

Create multiple custom option groups for different environments, such as development, staging, or production.

Track changes to option groups

Take the following actions:

• Use AWS CloudTrail to log API operations that are related to option group modifications.
• Create Amazon EventBridge rules to monitor and respond to option group changes.
• Use AWS Config rules to analyze the configurations of your option groups.

Use best practices to manage option groups

When you use option groups, implement the following best practices:

• Use descriptive names for your option groups to easily identify their purpose.
• Document your option group configurations and the reasons for specific settings.
• Test option group changes in a non-production environment before you apply them to production instances.
• Regularly review your option groups to make sure that they still meet your requirements and comply with your security policies.
• Use AWS Organizations and service control policies (SCPs) to control who can modify option groups across your organization.

Troubleshoot issues

If you encounter issues with option groups, then take the following steps:

• Check the Amazon RDS event logs for error messages that are related to option group changes.
• Verify that your AWS Identity and Access Management (IAM) user or role has the necessary permissions to modify option groups. For more information, see How Amazon RDS works with IAM.
• Verify that the options that you're trying to add are compatible with your DB instance's SQL Server version and edition.
• If you must modify an option configuration, such as to add port settings or security groups, then confirm that your configuration is correct.

Related information

Working with option groups

Options for the Microsoft SQL Server database engine