Amazon RDS for SQL Server now supports cross-database access using module signing with certificates as a secure alternative to TRUSTWORTHY. This method allows granting permissions to specific stored procedures without enabling the database-level trust flag. The approach provides a stronger, least-privilege security posture for multi-database scenarios.
- Avoid TRUSTWORTHY setting to maintain security on RDS SQL Server instances
- Use module signing with certificates for granular cross-database permissions
- Securely grant stored procedure access across databases without broad trust
- Implement least-privilege access for complex multi-database SQL Server workloads
Fleet impact: For Oracle ExaCC/RAC and AWS Aurora PostgreSQL/MySQL + RDS fleets: This AWS-specific SQL Server feature highlights a security pattern (module signing vs TRUSTWORTHY) that contrasts with Aurora's default isolation. On Aurora, cross-database access is not natively supported; ensure your migration strategy accounts for this architectural difference and leverages Aurora's native security controls or application-level routing instead.