Creating a certificate in an RDS Microsoft SQL server master database

Question

Is there any way to create a certificate in the master database on a Microsoft SQL Server running in RDS? I get permission denied errors when attempting it with the default admin account on an SQL Server Standard 2019.

The exact command that fails is this:
```
CREATE CERTIFICATE etl_kill_cert
    ENCRYPTION BY PASSWORD = 'ChangeThisToA_StrongPassword!123'
    WITH SUBJECT     = 'Certificate for ETL kill procedure',
    EXPIRY_DATE = '2099-12-31';
```

The reason I want to do this is that I need a "low level" database user to be able to run a stored procedure that requires server level permissions. It is my understanding that the way to accomplish this would be to perform the following steps:
1. Create a certificate in the master database.
2. Sign the stored procedure with the certificate.
3. Create a login from that certificate.
4. Assign the appropriate permissions to the login (in this case VIEW SERVER STATE and ALTER ANY CONNECTION).

Sukhman Singh · Accepted Answer

Unfortunately, AWS RDS SQL Server doesn't allow creating certificates in the master database due to platform limitations—RDS restricts cryptographic operations to prevent security issues, blocking the CREATE CERTIFICATE command even with admin privileges. You'll need to use an alternative approach: either create the certificate in a user database (not master) and manage permissions differently, or use AWS IAM authentication combined with RDS-specific stored procedures. For your specific need (low-level user needing VIEW SERVER STATE and ALTER ANY CONNECTION), consider using RDS's built-in rdsadmin role if applicable, or implement a workaround with scheduled tasks and RDS event notifications instead of certificate-based signing, though these won't provide the exact same security granularity.

Creating a certificate in an RDS Microsoft SQL server master database

Add your answer

Relevant content