Cross-cloud transformation: Amazon RDS for SQL Server to Azure SQL Managed Instance

#1. Plan

• Network: there's no direct private path by default. Options: send backups over HTTPS (simplest), or a site-to-site VPN between AWS and Azure for DMS-style replication.
• Downtime: with backups + LRS, downtime = final log backup + copy + restore (minutes to tens of minutes).
• Egress cost from AWS for the backup data volume — include it in the plan.

#2. Back up on RDS to S3

RDS native backup option (SQLSERVER_BACKUP_RESTORE) must be enabled (see the RDS native backup post).

EXEC msdb.dbo.rds_backup_database
  @source_db_name = 'Sales',
  @s3_arn_to_backup_to = 'arn:aws:s3:::sql-xcloud/sales/Sales_full.bak',
  @type = 'FULL', @number_of_files = 4;

EXEC msdb.dbo.rds_task_status @db_name = 'Sales';

rds_backup_database supports FULL and DIFFERENTIAL backups. Take differentials as you go so the final one at cutover is small:

EXEC msdb.dbo.rds_backup_database @source_db_name = 'Sales',
  @s3_arn_to_backup_to = 'arn:aws:s3:::sql-xcloud/sales/Sales_diff_1.bak', @type = 'DIFFERENTIAL';

RDS also offers access to its own transaction log backups (copying them to S3 with the rds_tlog_copy_setup / rds_tlog_backup_copy_to_S3 procedures). Whether those files can be applied by LRS in your setup is something to prove in a rehearsal; plan on full + differential unless the test succeeds.

Note

With full + differential only, downtime equals the final differential backup + copy + restore. For tighter windows, use CDC-based replication instead (for example AWS DMS over a VPN between the clouds, or a third-party replication tool).

#3. Copy to Azure Blob Storage

azcopy copies directly from S3 to Blob Storage (server-to-server):

export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
azcopy copy "https://sql-xcloud.s3.ap-south-1.amazonaws.com/sales/" \
  "https://stmig.blob.core.windows.net/backups/sales/?<sas>" --recursive

#4. Restore with Log Replay Service

az sql midb log-replay start -g rg-sql --mi sqlmi-prod -n Sales \
  --storage-uri "https://stmig.blob.core.windows.net/backups/sales" --storage-sas "<sas>"

Upload the full first, then the differential(s). At cutover: stop the app, take the final differential on RDS, copy it, then:

az sql midb log-replay complete -g rg-sql --mi sqlmi-prod -n Sales --last-backup-name "Sales_diff_final.bak"

LRS requires backups with checksums. Check a test file with RESTORE HEADERONLY (the HasBackupChecksums column) during the rehearsal.

#5. TDE and encryption

• If the RDS database uses TDE, export the TDE certificate from RDS (RDS procedures for TDE certificates) and upload it to MI before restoring — or remove TDE before the final backup and enable service-managed TDE on MI.
• S3 SSE-KMS encryption: the azcopy credentials need kms:Decrypt.

#6. Logins and identity

• SQL logins: recreate on MI (script with sp_help_revlogin equivalent or dbatools against RDS).
• Windows logins from AWS Managed AD → Entra ID users/groups on MI (or MI Windows auth with Kerberos if AD is synced to Entra).

#7. Cutover

Follow the cutover runbook: freeze writes, final backup, copy, complete LRS, switch connection strings, smoke tests. Keep RDS available (read-only) until sign-off, then take a final snapshot and delete it.

Tip

Rehearse once end to end and time each step. Copy speed between clouds varies widely; the rehearsal tells you whether the final differential fits the downtime window or whether you need CDC-based replication.