rds-sqlserver

Diagnose and configure connectivity, authentication, and encryption for Amazon RDS for SQL Server.

2.5k|282|Updated Apr 23, 2026
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill rds-sqlserver
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rds-sqlserver
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/database-skills/rds-sqlserver
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill rds-sqlserver

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Connecting applications to Amazon RDS for SQL Server fails in predictable but hard-to-diagnose ways: SSMS timeouts from EC2, "Cannot generate SSPI context" with Windows auth, Kerberos silently falling back to NTLM on ECS Fargate, and Lambda functions timing out on pre-login handshakes. This Skill provides systematic troubleshooting workflows and correct driver configurations for each scenario.

Core Features & Use Cases

  • Driver-specific connection guidance: Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (mssql-jdbc), and Node.js (tedious) with correct TLS, port, and TDS version settings.
  • Authentication workflows: Walks through SQL auth with Secrets Manager rotation, Windows auth via AWS Managed Microsoft AD with SPN/CNAME setup, and IAM auth through RDS Proxy.
  • Deployment patterns: Provides networking and credential configurations for EC2, ECS Fargate, Lambda in VPC, EKS, and laptop access via SSM port forwarding.
  • Use Case: A developer's Lambda function using pymssql gets error 18456 and pre-login timeouts. The Skill supplies a complete handler with Secrets Manager credential caching at module scope, encryption='require', tds_version='7.4', port passed as a string, and explicit exception handlers for both error conditions.

Quick Start

Ask the agent to help you connect your application to your RDS for SQL Server instance, specifying your language, runtime environment, and authentication method.

Frequently Asked Questions about rds-sqlserver

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix SSMS timing out when connecting to RDS SQL Server from EC2?

Check the RDS security group allows inbound TCP 1433 from the EC2 instance's security group by SG ID, verify DNS resolution of the RDS endpoint returns a private IP, and test TCP connectivity with Test-NetConnection on port 1433. Also try SSMS Options → Connection Properties → Network Protocol = TCP/IP.

How do I connect Lambda to RDS SQL Server using pymssql?

Use pymssql with encryption='require', tds_version='7.4', and the port passed as a string ('1433'). Fetch credentials from Secrets Manager at module scope so warm invocations reuse them, place the Lambda in a VPC with a Secrets Manager VPC endpoint, and add exception handlers for error 18456 and pre-login timeouts.

Why does auth_scheme show NTLM instead of KERBEROS on ECS Fargate?

Kerberos fell back to NTLM, usually because the client connected to the RDS endpoint instead of the AD-registered CNAME that matches the SPN. Verify the SPN MSSQLSvc/<cname>:1433 exists with setspn, and confirm the task can reach domain controllers on ports 53, 88, 389, 445, and 464.

Does RDS for SQL Server support IAM database authentication?

RDS for SQL Server does not support IAM authentication directly on the instance. IAM auth requires placing RDS Proxy in front of the instance and connecting through the proxy endpoint with IAM tokens.

Can I use pymssql for Windows authentication with Kerberos?

No, pymssql does not support Kerberos. Use pyodbc with the ODBC Driver 18 for SQL Server and Trusted_Connection=Yes on a domain-joined host, connecting to the AD CNAME rather than the RDS endpoint.

Why do I get 'Cannot generate SSPI context' with Windows auth?

This indicates a Kerberos handshake failure. Run klist to check for a ticket for MSSQLSvc/<cname>:1433, verify the client is domain-joined, confirm the SPN is registered in AD for the CNAME, and ensure DNS resolves the CNAME matching the SPN hostname.