Vault on-prem migration to AWS

[JamesGreen]

Hi Guys,

I was hoping to migrate our local Vault server to a VM at AWS and use RDS (MS SQL Server) for the database.

Unfortunately I have hit a snag in the database migration plan. Because it is not possible to restore a new database from backup in RDS, their recommended method is to script the schema then bulk-export/bulk-import the rows.

This has worked for a couple of other databases we have but we are unable to script the Vault database because SQL Server Management Studio is not able to script the encrypted stored procs.

Is it possible to migrate the Vault databases to RDS?

I have also tried exporting a Data-tier Application however that does not like some of the views in sgvault referencing objects in sgmaster etc.

Would very interested in hearing if anyone has had success with this.

Cheers, James

[lbauer]

Is it possible to migrate the Vault databases to RDS?

We have not tested this. Is it possible to detach the databases, then attach them, rather than restoring from a backup? You could still make a backup for your own purposes.

[JamesGreen]

Thank you for your quick reply Linda,

Unfortunately in RDS there isn't access to the SQL Server's filesystem so attach isn't possible.

As an experiment I tried a new Vault install pointing to the Vault Server Setup directly at the RDS instance, which seemed to get along for a while but failed at the following point:

Code: Select all

Looking for IIS Version 
Configuring your new Vault Professional Installation
Requesting the IIS Process User...
You chose website: 'Default Web Site'
Modifying VaultAppPool...
Properties: Id=ApplicationPoolIdentity, .NET=v4.0, Mode=Integrated
Modifying VaultShadowFolderAppPool...
Properties: Id=ApplicationPoolIdentity, .NET=v4.0, Mode=Integrated
Modifying VaultIndexAppPool...
Properties: Id=ApplicationPoolIdentity, .NET=v4.0, Mode=Integrated
Modifying VaultNotifyAppPool...
Properties: Id=ApplicationPoolIdentity, .NET=v4.0, Mode=Integrated
Modifying SgDavAppPool...
Properties: Id=ApplicationPoolIdentity, .NET=v4.0, Mode=Classic
Creating Applications in IIS for web services...
VaultService application created.
Creating Applications in IIS for Vault Professional Work Item web services...
Vault Professional application created.
Creating Applications in IIS for VaultShadowFolder web services...
VaultShadowFolder application created.
Creating Applications in IIS for Find in Files Index web services...
VaultIndexService application created.
Creating Applications in IIS for Notification web services...
VaultNotificationService application created.
Creating Applications in IIS for SdDav web services...
SgDav application created.
Creating Virtual Directories...
VaultService Virtual Directory created.
Vault Professional Virtual Directory created.
VaultShadowFolder Virtual Directory created.
VaultIndexService Virtual Directory created.
VaultNotificationService Virtual Directory created.
SgDav Virtual Directory created.
Requesting Admin user password...OK
Connecting to the SQL Server...OK
Verifying the SQL Server requirements...OK
Checking for existing databases...Not found.
Creating a new Vault Professional database on db-xxx.yyy.ap-southeast-2.rds.amazonaws.com,1433...
	Creating the SourceGear master database...OK
	Creating the SourceGear source control database...OK
	Creating the SourceGear work item tracking database...OK
	Creating the SourceGear indexing database...OK
	Creating the SourceGear notification database...OK
	Creating SourceGear master stored procedures...OK
	Creating SourceGear source control stored procedures...Only the owner of database "master" or someone with relevant permissions can run the CHECKPOINT statement.
Vault Professional Setup is exiting due to a failure or cancellation. Error Code = 402

Which seems consistent with the restrictions RDS imposes on Master. It looks like RDS requires that the database be able to be scripted & bulk-loaded for migration. Would there be any options available for this with Vault?

Many thanks
James

[lbauer]

You could script / bulk-copy all the schema (including indices, foreign keys, and views) and table rows, but you'll still need to install Vault. The Vault Server installer will find the database, and create the missing user functions / stored procedures.

Our install scripts call CHECKPOINT in order to flush everything to the database. So on AWS you can't run the installers unless someone with admin privileges to SQL Server runs the install.

There are no work-arounds for this, so at this point, we'll have to say installing Vault Server in this environment is unsupported.

I'll log a feature request to support installing a Vault database in RDS.

[JamesGreen]

Thanks for another prompt reply Linda!

At the moment RDS creates a 'master' user in the SQL Server instance which is then used to create databases in the instance, but that account has limited access to master and is definitely not sa.

The option we have gone with is to migrate to a SQL Express instance (since sgvault is still <20Gb) inside an EC2 VM which will do for the time being but RDS support would still be greatly appreciated should it be introduced in the future.

Best regards
James

[lbauer]

I've logged work item 17040 for support of RDS.

It's something we need to think about, since some companies are moving apps to the Cloud.