Need a long term solution feasible to scale up my user base for access to RDS SQL Server.

0

I have hosted an AWS Managed MS Active Directory and joined to AWS RDS SQL Server to the AD Domain.
Option -1 : Create a SQL login for each user and ask the user to login to the SQL server with new login. And provide appropriate grants for the SQL Server login. Option -2 : Enable Windows Authentication. Create a Database login for the each user in AD and provide grants individually.

For a large organization this could be laborious Can you help me with how I can scale this user access method. Also how to give user access to a group and some roles on server or database level ? and also how to give fine grained access (both deny and allow). IAM Roles and Groups cannot be used here as they are limited at DBA level but not inside the Database or SQL server instance level. Do provide with various possibilities too that are feasible. Please provide the relevant links and resources for the same

1 Answer
1

To scale up your user base for access to RDS SQL Server while minimizing administrative overhead, you can leverage your existing Active Directory infrastructure and SQL Server roles:

  1. Establish a trust relationship: If you have an on-premises Active Directory already set up with users defined, you can establish a one-way trust between your on-premises AD and your AWS Managed Microsoft AD. This will allow you to avoid duplicating user creation in the AWS Managed AD. You can find more information on setting up the trust relationship in the AWS Managed Microsoft AD.

  2. Organize users into groups: Rather than managing individual users, organize your users into groups in your Active Directory based on their roles, such as Administrators, Developers, and Application Users. This will make it easier to manage permissions and access control on a group level.

  3. Leverage SQL Server roles: Use roles within SQL Server to manage permissions and access for the groups you created in step 2. By assigning the appropriate roles to each group, you can grant access to resources at the server or database level, as well as apply fine-grained access control (both deny and allow).

  • Server-level roles: You can use predefined server-level roles, like sysadmin, serveradmin, or securityadmin, or create custom server-level roles to fit your organization's needs. Grant these roles to the corresponding AD groups. For more information, refer to the SQL Server documentation on server-level roles.

  • Database-level roles: Similarly, you can use predefined database-level roles, like db_owner, db_datareader, or db_datawriter, or create custom database-level roles. Grant these roles to the corresponding AD groups. For more information, refer to the SQL Server documentation on database-level roles.

AWS
Rafet
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions