Implementing a fall forward strategy from Amazon RDS for SQL Server Transparent Data Encryption (TDE) and Non-TDE Enabled databases to self-managed SQL Server

This article discusses how to implement a "fall forward" rollback strategy for migrating databases from Amazon RDS for SQL Server to a self-managed SQL Server instance. A fall forward approach replicates data from the migrated database to a third environment without impacting the source, allowing rollback if needed.

Specifically, the article covers:

• Overview of the fall forward rollback strategy
• Solution architecture diagram
• Prerequisites (RDS SQL Server instance, EC2 instance with SQL Server, AWS CLI, Python, etc.)
• Step-by-step guide for setting up the fall forward strategy:
  • Creating S3 buckets for backups/logs and certificates
  • Creating an IAM role and policy for S3 access
  • Creating a KMS key for encryption
  • Backing up and restoring TDE certificates (for encrypted databases)
  • Backing up databases and transaction logs from RDS to S3
  • Decrypting logs using a Python script and applying to self-managed SQL Server
• Cleanup steps to remove resources