Question: How do I create a linked server in RDS for SQL Server with the source as RDS?

I want to create a linked server from an Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server instance to SQL Server. How can I do this?Short descriptionAmazon RDS is a managed service, so users don't have sysadmin access. Directly creating a linked server from a GUI results in an error. To create a linked server, use T-SQL. The only supported targets are SQL Server.PrerequisitesYou must have connectivity between RDS for SQL Server and the target SQL Server.Note: The linked server password and configuration remains intact even after a host replacement.

ResolutionRDS for SQL Server instance to RDS for SQL Server instanceIt's a best practice to use the DNS name when creating a linked server with RDS for SQL Server as the source to RDS for SQL Server as the target. Using the DNS name prevents IP address changes due to host replacements or server changes.In Amazon RDS, IP addresses are dynamic and endpoints are static. So, it’s a best practice to use endpoints to connect to your instance. Every Amazon RDS instance has an endpoint.Parameters:@server: Your linked server name.@datasrc: Your RDS endpoint name. For Amazon Elastic Compute Cloud (Amazon EC2) on-premises instance your EC2 on-premises IP address or DNS name.@rmtuser: The login name that has access to the target database.@rmtpassword: The password for the login name.Step 1: Connect to the RDS for SQL Server instanceConnect to the instance using the master login and then run the following command. Make sure that you're using the endpoint and not the IP address. IP addresses of RDS instances might change during a host replacement.EXEC master .dbo.sp_addlinkedserver @server = N'LinkedServerRDSSQL', @srvproduct= N'', @provider= N'SQLNCLI', @datasrc= N'SQL-2019.ckeixtynaaaj.us-east-1.rds.amazonaws.com'goEXEC master .dbo.sp_addlinkedsrvlogin @rmtsrvname=N'LinkedServerRDSSQL' ,@useself=N'False' ,@locallogin=NULL,@rmtuser =N'linkedserverloginname',@rmtpassword='YourStrongPassword'goStep 2: Test the linked server1.    In Microsoft SQL Server Management Studio (SSMS), connect to the RDS instance.2.    On the View menu, select Object Explorer.3.    Select Server Objects, Linked Servers.4.    Right-click your server name, and then select Test the connection.Step 3: Query the linked serverRun the following query:select * from [LinkedServerName].[Databasename].[schemaname].[tablename]RDS for SQL Server instance to an EC2 SQL Server instance or an on-premises SQL ServerStep 1: Create the linked serverCreate the linked server with RDS for SQL Server as the source to SQL Server on an EC2 instance or to an on-premises SQL Server.Run the following commands to create the linked server using the IP address for the remote server:EXEC master .dbo.sp_addlinkedserver @server = N'LinkedServerRDSSQL', @srvproduct= N'', @provider= N'SQLNCLI', @datasrc= N'10.0.0.152'GoEXEC master .dbo.sp_addlinkedsrvlogin @rmtsrvname=N'LinkedServerRDSSQL' ,@useself=N'False' ,@locallogin=NULL,@rmtuser =N'linkedserverloginname',@rmtpassword='YourStrongPassword'GoRun the following commands to create the linked server using the DNS name for the remote server:EXEC master .dbo.sp_addlinkedserver @server = N'LinkedServerRDSSQL', @srvproduct= N'', @provider= N'SQLNCLI', @datasrc= N'ServerName.datacenter.mycompany.com'GoEXEC master .dbo.sp_addlinkedsrvlogin @rmtsrvname=N'LinkedServerRDSSQL' ,@useself=N'False' ,@locallogin=NULL,@rmtuser =N'linkedserverloginname',@rmtpassword='YourStrongPassword'goStep 2: Test the linked server1.    In Microsoft SQL Server Management Studio (SSMS), connect to the RDS instance.2.    On the View menu, select Object Explorer.3.    Select Server Objects, Linked Servers.4.    Right-click your server name, and then select Test the connection.Step 3: Query the linked serverRun the following query:select * from [LinkedServerName].[Databasename].[schemaname].[tablename]Configure the linked server using Microsoft Windows AuthenticationNote: Configuring a linked server from RDS for SQL Server to an EC2 instance or to an on-premises SQL Server using Windows Authentication isn't supported.PrerequisitesYou must have the domain created and joined with the AWS Managed Microsoft AD.The source EC2 SQL Server instance and target RDS SQL Server must have connectivity.Step 1: Configure the linked server from an EC2 or on-premises SQL Server to RDS for SQL Server using Windows Authentication1.    Log in with your domain login and run the following query to create the linked server.USE [master]GOEXEC sp_addlinkedserver    @server=N'LinkedServerToRDSInstance',@srvproduct=N'',@provider=N'SQLNCLI',@datasrc=N'EndpointName';GOEXEC master.dbo.sp_addlinkedsrvlogin @rmtsrvname = N'LinkedServerToRDSInstance', @locallogin = NULL , @useself = N'True'GOStep 2: Test the linked server1.    In Microsoft SQL Server Management Studio (SSMS), connect to the RDS instance.2.    On the View menu, select Object Explorer.3.    Select Server Objects, Linked Servers.4.    Right-click your server name, then select Test the connection.Step 3: Query the linked serverRun the following query:select * from [LinkedServerName].[Databasename].[schemaname].[tablename]TroubleshootingYou might receive the following error message when connecting from the client:Msg 18456, Level 14, State 1, Line 21Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'This error is caused by a "double hop". A double hop occurs when one computer connects to another computer to connect to a third computer. Double hops might occur in the following scenarios:There isn't a service principal name configuration (SPN) for AWS Managed AD to process the authentication between the client and the EC2 instance.The linked server is configured using an endpoint that isn't from your domain, such as the RDS instance endpoint. The authentication method to both EC2 and RDS needs to be KERBEROS.To resolve this issue, do the following:Step 1. Check the authentication method to confirm KERBEROS is being picked when connecting to both RDS and EC2Run the following query using the domain login from the client:select @@servername as ServerName, session_id,net_transport, auth_scheme from sys.dm_exec_connections where session_id= @@spid;Step 2: Correct the SPNs for the SQL Server service account that is part of your domain1.    In Active Directory Users and Computers, select YourDomain.com, YourDomain, Users.2.    Right-click YourServiceAccount to view the properties.3.    In the Delegation tab, choose Trust this user for delegation to any service (Kerberos only), and then select OK.4.    Restart the SQL server service on the EC2 instance or the on-premises SQL Server.5.     Add the SPN for the service account as shown in the following example command. Replace YourDomainName\ServiceAccountName and the Ec2name domain with the correct values for your domain.setspn -A MSSQLSvc/Ec2name.domain.com YourDomainName\ServiceAccountNamesetspn -A MSSQLSvc/Ec2name.domain.com:1433 YourDomainName\ServiceAccountName6.    Run the following command to verify the newly created SPNs:setspn -l YourDomainName\ServiceAccountNameStep 3: Recreate the linked server using RDS YourDomain.com endpoint1.    Run the following query in RDS for SQL Server to retrieve the server name:select @@servername as ServerName, session_id,net_transport, auth_scheme from sys.dm_exec_connections where session_id= @@spid;2.    In the output from the preceding command, check the server name column to verify the SPN, as shown in the following example.setspn -l YourServerNameThe preceding command output also shows the registered ServicePrincipalNames for your RDS instance, as shown in the following example:MSSQLSvc/ YourServerName.yourdomainname.com:14333.    Run the following command to recreate the linked server using the domain login. The data source is the same that you retrieved from the command output in step 2.USE [master]GOEXEC sp_addlinkedserver    @server=N'LinkedServerToRDSInstance',@srvproduct=N'',@provider=N'SQLNCLI',@datasrc=N'YourServerName.YourDomainnanme,com';GOEXEC master.dbo.sp_addlinkedsrvlogin @rmtsrvname = N'LinkedServerToRDSInstance', @locallogin = NULL , @useself = N'True'GO4.    Test connectivity from the client.Note: Currently a linked server is supported as the target for SQL Server. This is because Amazon RDS is managed service. You don't have the OS access to install additional ODBC or any of the drivers required to connect different database servers such as Oracle,MYSQL,PostGreSQL.For heterogenous linked servers, you can use RDS Custom for SQL Server.

Related informationImplement linked servers with Amazon RDS for Microsoft SQL Server