Azure SQL to STACKIT SQLServer Flex

A logical server and its database, converted

A small estate written for this page and assessed by StackToIT on 4 November 2026. Left: the input. Right: the resource blocks of the STACKIT Terraform the engine wrote; the review comments that sit above each block in the file are left out here.

resource "azurerm_mssql_server" "orders" {
  name                          = "sql-orders-gwc"
  resource_group_name           = azurerm_resource_group.data.name
  location                      = azurerm_resource_group.data.location
  version                       = "12.0"
  administrator_login           = "ordersadmin"
  administrator_login_password  = var.sql_admin_password
  minimum_tls_version           = "1.2"
  public_network_access_enabled = false
}

resource "azurerm_mssql_database" "orders" {
  name         = "orders"
  server_id    = azurerm_mssql_server.orders.id
  sku_name     = "GP_Gen5_4"
  max_size_gb  = 128
  collation    = "SQL_Latin1_General_CP1_CI_AS"
  license_type = "LicenseIncluded"

  short_term_retention_policy {
    retention_days = 14
  }
}

resource "stackit_sqlserverflex_instance" "orders" {
  project_id = var.project_id
  name       = "sql-orders-gwc"
  flavor_id  = var.orders_flavor_id
  storage = {
    class = var.sqlserverflex_storage_class
    size  = var.orders_storage_size
  }
  backup_schedule = "0 2 * * *"
  network = {
    acl = var.orders_allowed_cidrs
  }
  version        = "2022"
  retention_days = 30
}

• One instance hosts the databases

  Azure SQL Database is a database-level service; SQLServer Flex runs an instance that hosts databases. The code writes one instance for the logical server and lists orders as the database to create in it.

• Version and flavor from the eu01 catalogue

  2022 is the SQLServer Flex version of the eu01 catalogue. For GP_Gen5_4 the flavor variable names 4.16-Single, with 4 vCPU and 16 GiB. Single-node flavors fit, because no database is Business Critical, Premium or zone-redundant.

• Backups on a STACKIT schedule

  Azure SQL backs up automatically and states no schedule, so the code sets a daily backup at 02:00 and 30 days of retention, the lower end of the 30 to 90 days STACKIT offers.

• Every other setting named

  The administrator login becomes users created with stackit_sqlserverflex_user, and the collation moves to the database resource. Minimum TLS version and the public network switch have no counterpart, and the code says so line by line.

The private endpoint, assessed

From the same run. A private endpoint has no STACKIT resource to become, so the run writes no Terraform for it and records a decision instead. Left: the input. Right: that decision as assessment.json records it (id, class, confidence and target; the reason field is summarised below).

resource "azurerm_private_endpoint" "orders_sql" {
  name                = "pe-sql-orders"
  location            = azurerm_resource_group.data.location
  resource_group_name = azurerm_resource_group.data.name
  subnet_id           = azurerm_subnet.endpoints.id

  private_service_connection {
    name                           = "psc-sql-orders"
    private_connection_resource_id = azurerm_mssql_server.orders.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }
}

{
  "id": "azurerm_private_endpoint.orders_sql",
  "class": "REDESIGN",
  "confidence": "LOW",
  "target": {
    "service": "none — no Private Link equivalent"
  }
}

• Reach through the access list

  STACKIT managed services are reached on their own endpoint and restricted by an access list. The variable for the allowed CIDRs has no default: you list the STACKIT network prefixes of the clients.

• Endpoint scope is your decision

  For a database that is private in Azure, the STACKIT endpoint scope is a decision for your architect. Left unset, the STACKIT API makes the endpoint public, so decide it for each such database before anything is applied.

• A private address where it is mandatory

  SQLServer Flex and PostgreSQL Flex can be scoped to a STACKIT Network Area, an opt-in for enabled accounts. Otherwise a service that must have a private address runs inside the network, on servers or SKE.

How the Azure SQL estate maps

Classes as the run decided them. The database is part of the server unit, because it moves into the instance that replaces the server.

How the data moves

1. 01

   Export and import

   Schema and data move with a BACPAC export and import, or with transactional tooling. SQLServer Flex takes no native .bak upload, so plan the move around the export.

2. 02

   Logins

   Logins are re-created as SQL logins on the new instance, and the run asks how administrators sign in.

3. 03

   Storage for the whole instance

   An Azure SQL logical server states no storage size; each database has its own maximum. You set the storage of the instance, sized for all its databases together.

4. 04

   Resource groups

   STACKIT has no resource groups. The run asks how the boundaries of the source resource groups map to STACKIT projects and roles.

Questions database teams ask

Sources

• Microsoft Learn: Import a BACPAC file to Azure SQL Database
• STACKIT Docs: SQLServer Flex