When to choose RDS Custom
Standard RDS blocks some things legacy apps need. RDS Custom lets you:
- Log in to the host OS (RDP/SSM) and install agents, drivers or third-party tools.
- Use sysadmin-level features and settings not allowed on RDS.
- Apply specific configurations or customisations required by vendor apps.
You still get AWS-managed backups, point-in-time restore, monitoring and automation, with some responsibilities shared.
| RDS | RDS Custom | EC2 | |
|---|---|---|---|
| OS access | No | Yes | Yes |
| sysadmin | No | Yes | Yes |
| Automated backups / PITR | Yes | Yes | Do it yourself |
| Patching | AWS | You choose versions (with AWS help) | You |
| HA | Multi-AZ | Multi-AZ (check current support) | AG/FCI yourself |
1. Prerequisites
- VPC with private subnets, VPC endpoints (or NAT) for the services RDS Custom needs (S3, SSM, CloudWatch, Secrets Manager, etc.).
- An IAM instance profile and role as described in the RDS Custom setup docs.
- A KMS symmetric key for encryption.
- Licensing model: license included, or BYOM (bring your own media) with your own licence where offered.
AWS provides a CloudFormation template for the networking and IAM prerequisites — use it.
2. Create the instance
# pick a version from: aws rds describe-db-engine-versions --engine custom-sqlserver-se
aws rds create-db-instance --engine custom-sqlserver-se --engine-version "$ENGINE_VERSION" \
--db-instance-identifier rdsc-erp-prod --db-instance-class db.r6i.2xlarge \
--allocated-storage 500 --storage-type gp3 \
--master-username admin --manage-master-user-password \
--kms-key-id arn:aws:kms:ap-south-1:111122223333:key/... \
--custom-iam-instance-profile AWSRDSCustomSQLServerInstanceProfile \
--db-subnet-group-name dbsg-private --no-publicly-accessible
3. Migrate data
Native backup/restore works the same way as on EC2, because you have OS access: copy .bak files from S3 to the host and restore with SSMS/T-SQL. Or use DMS / log shipping from the source.
4. Customisations: pause automation first
Before changing the OS or SQL configuration, pause RDS Custom automation, so its monitoring doesn't treat your change as a fault:
aws rds modify-db-instance --db-instance-identifier rdsc-erp-prod \
--automation-mode all-paused --resume-full-automation-mode-minutes 120
Make the change, then resume automation (--automation-mode full). Changes outside the support perimeter (for example deleting RDS Custom agents or changing the service account) put the instance in an unsupported state.
5. Operations
- Backups and PITR managed by RDS; also take your own native backups if the app vendor requires them.
- CloudWatch metrics and logs; SSM Session Manager for OS access (no open RDP).
- Version upgrades: RDS Custom supports minor version upgrades through the RDS API; plan major upgrades per AWS guidance.
Tip
Use RDS Custom only for the apps that genuinely need it. Every customisation increases operational effort; standard RDS or Azure SQL MI remains the lower-effort target for everything else.