Windows Server Recommendations For AWS

Windows Server Recommendations for AWS.md

Windows Server Recommendations for AWS

Overview

This document gives a high-level recommendation for building a Windows Server EC2 host in AWS. It also covers support for Windows Server Failover Clustering (WSFC).

Table of Contents

EC2 Host Recommendations

This section gives recommendations for an EC2 host in AWS. It covers instance type and storage.

  • Use the r6idn or i3en instance type for a SQL Server host in AWS. Both instance types come with NVMe SSD storage.
  • Use the NVMe SSD storage for tempdb only. This storage is destroyed if the host stops or dies.
  • If you set up WSFC in one AWS region, use the same instance type and size on every node. Example: r6idn.4xlarge.
  • If you set up WSFC across AWS regions, you can use a different instance size, but keep the same instance type. Example: r6idn.large.

NOTE: See AWS Storage for a description of each volume type. See AWS EBS Pricing for current prices.

EC2 Network Recommendations

This section gives recommendations for networking in AWS.

  • Each EC2 host has one real network path. You can attach more than one network interface (ENI) to the host, but every ENI shares that same underlying network. An additional ENI does not give the host a separate or faster path, so it does not improve WSFC heartbeat reliability.
  • When you create an EC2 host, put every IP address on a private network interface. Use a proxy for outbound access. Do not put any IP address on a NAT network range.
  • If you are creating a WSFC, put each cluster node in a different Availability Zone. Within our AWS accounts, most teams default to Availability Zone A when they launch new resources. As a result, Availability Zone A fills up faster than the other zones. Reserve Availability Zone A for the file share witness, and place each cluster node in one of the other Availability Zones.
  • Assign more than one secondary IP address to your EC2 host. For a WSFC, you need 1 secondary IP address for the Cluster Name. You need one more secondary IP address for each SQL Server Availability Group listener [single-IP or multi-IP setup]. A good practice is to start with 3 secondary IP addresses, and add more as needed.
  • Set HostRecordTTL on the WSFC Cluster Name resource to 15 seconds, instead of the default 1200 seconds (20 minutes).
  • Set HostRecordTTL on a single-IP Availability Group Listener to 15 seconds. Set HostRecordTTL on a multi-IP Availability Group Listener to 60 seconds.
  • Set RegisterAllProvidersIP to 0 on the Listener resource. This setting, together with a short HostRecordTTL, helps an older client driver, without MultiSubnetFailover support, find the new active replica faster after a failover.
  • Set the Possible Owners property on each cluster IP address resource, to the one node that owns that address. EC2 cannot share an IP address between instances. A cluster IP resource can only come online on its own node. When you set Possible Owners, you remove the delay, and the harmless-but-confusing error messages, that appear when the cluster tries the address on every node. See Best practices and recommendations for SQL Server clustering on Amazon EC2 for both settings.

EC2 Security Recommendations

This section gives recommendations for security in AWS.

To perform networking actions within AWS, you can assign up to 5 security groups to one EC2 host.

Security Group 1: Internal Region Traffic

This group makes sure that every EC2 host, in the same AWS region, can talk to one another without restriction. See Security group rules reference, under Rules to connect to instances from an instance with the same security group.

NOTE: Keep this security group specific to this EC2 host or hosts in the AWS region.

Security Group 2: Inbound Windows and SQL Server Access

This group allows Windows and SQL Server connectivity from outside the host [ingress rules]. See WSFC_SQLServer.md in this folder for the full, verified port list.

Port(s) Protocol Service Notes
135 TCP RPC Endpoint Mapper —
1433 TCP SQL Server Database Engine —
1434 TCP SQL Server Dedicated Admin Connection (DAC) Default instance only. Loopback only, unless remote admin connections are enabled. See Diagnostic Connection for Database Administrators and Server Configuration: remote admin connections.
1434 UDP SQL Server Browser service Named instance discovery. See SQL Server Browser Service.
2382-2383 TCP SQL Server Analysis Services —
3389 TCP and UDP RDP Modern RDP uses both channels together. See Ports used by RDS.
5022 TCP AG database mirroring endpoint This port is a common convention, not a fixed default. It is fully configurable. See Database mirroring endpoint (PowerShell).
5985-5986 TCP WinRM (PowerShell Remoting) —

NOTE: Keep this security group generic. Use it for any EC2 host.

Security Group 3: Outbound Access

This group allows outbound access to Active Directory and other internal services [egress rules].

Port: ALL TCP and UDP, to your internal network range only. Example: 10.50.0.0/16. Use your own network's actual range here. Do not use 0.0.0.0/0 for this rule — that range means the entire internet, not your internal network.

NOTE: Keep this security group generic. Use it for any EC2 host.

Security Group 4: Cross-Region WSFC and AG Traffic

This group allows cross-region access for WSFC and SQL Server AG traffic [ingress rules]. Specify every port listed in WSFC_SQLServer.md from the secondary region.

NOTE: Keep this security group generic. Use it for any EC2 host that is part of a WSFC. You need a security group for each region, to allow ingress traffic.

EC2 O/S Recommendations

This section gives recommendations for O/S configuration in AWS. Use PowerShell for every Windows O/S task, for example Storage Spaces.

Operating System Image

  • Use the AWS Windows Server 2022 or Windows Server 2025 Amazon Machine Image (AMI). If you bring your own license (BYOL), you must install SQL Server on the host yourself. Otherwise, use a pay-as-you-go AMI with SQL Server 2022 or SQL Server 2025 already installed.

    NOTE: AWS builds, patches, and maintains these AMIs. AWS typically completes this work within 5 business days of Microsoft's Patch Tuesday.

Network Configuration

  • Configure the primary IP address on the network card as a static IP. Do not assign the WSFC cluster IP address or any Availability Group IP address as a static IP on the network card. Windows Failover Cluster Manager must manage these addresses. If you assign them as static IP addresses on the network card, the instance can experience network drops during a failover event.
  • Configure the Elastic Network Adapter (ENA) driver on your EC2 host. Set Receive Buffers to 8192.
  • If your instance has more than 16 vCPUs, prevent Receive Side Scaling (RSS) from using CPU 0. This avoids contention with other system work on that core. Example: Set-NetAdapterRss -Name <ENA_adapter_name> -BaseProcessorGroup 0 -BaseProcessorNumber 1. See Best practices and recommendations for SQL Server clustering on Amazon EC2.

Drive Configuration

Configure the drives for a SQL Server host as follows:

Drive Contents Storage Type Size IOPS Throughput Notes
C Boot drive, pagefile gp3 100 GB — — Set the pagefile to 16 GB on this drive.
D User database data files gp3 Sized appropriately Minimum 5000 1000 MB/sec —
G User database backup files st1 Sized appropriately Adjust as needed Adjust as needed st1 performance scales with volume size. Size the volume to reach the IOPS and throughput your backup workload needs.
L User database log files gp3 Sized appropriately — 500 MB/sec —
S SQL Server installation, system databases gp3 30 GB — — —
T SQL Server tempdb NVMe SSD (instance store) Maximum available size — — You can stripe this drive with Storage Spaces. This drive resets if the EC2 host stops or dies. Recreate it using userdata.
  • Always create a folder under the D, G, L, S, and T drives, to house your binaries and files.
  • If you are setting up WSFC, make sure the drives and folders match 100% across every node.

Patching and Drivers

  • Use Windows Server Update Services (WSUS) to install the latest Windows O/S updates.
  • Install the latest SQL Server CU and SSMS updates through Windows Server Update Services (WSUS).
  • Install the latest AWS ENA and NVMe drivers, as they become available. r6idn and i3en run on the Nitro system, so PV drivers do not apply.

Backups

Comments

Post a Comment

Popular posts from this blog

Windows Server Failover Clustering/SQL Server Firewall Access Rules

This document defines the firewall rules required for a Multi-Subnet Windows Server Failover Cluster (WSFC) environment. It covers WSFC core communication, the WSFC dependency on Active Directory (AD), and SQL Server Availability Group (AG) communication. Use these rules when you request network access for a Multi-Subnet Cluster. This version corrects several rows to agree with current Microsoft documentation. See Verification Notes at the end of this document for the list of changes and sources. Table of Contents Best Practice: IP Specificity Critical Action: Review Ephemeral Port Ranges Section 1: Core WSFC and Active Directory Ports Section 2: SQL Server Database Engine and Availability Group Ports Section 3: SQL Server BI Stack Ports (Conditional) Section 4: Multi-Subnet / Cloud Deployment Ports (Conditional) Section 5: Official References Verification Notes Windows Server 2025 / SQL Server 2025 Notes Best Practice: IP Specificity Specify exact IP ad...
Read more

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster

Requirements for SQL Server AlwaysOn Feature on a Windows Server Failover Cluster.md This document targets Windows Server 2022 and SQL Server 2022. See Update Notes at the end of this document. That section lists what changed from the original 2012 version, and the reason for each change. Table of Contents Overview Terminology Windows Server Failover Clustering (WSFC) Cluster Name Object (CNO) Virtual Computer Object (VCO) Symmetric / Asymmetric Storage SQL Server Failover Clustered Instance (FCI) SQL Server Failover Clustered Instance CNAME (FCI CNAME) SQL Server Availability Group (AG) SQL Server Availability Group Listener (AGL) SQL Server Availability Group Listener CNAME (AGL CNAME) WSFC Requirements SQL Server FCI Requirements SQL Server Availability Group Requirements Update Notes Windows Server 2025 / SQL Server 2025 Notes Overview This document covers the SQL Server AlwaysOn feature. This includes the Failover Clustered Instance, the A...
Read more