Prerequisites

If Oracle AI Database@AWS subscription is activated in your buyer account before Autonomous Recovery Service GA date, then you must edit the IAM policies as described below.

1. Use the existing Oracle AI Database@AWS groups which are created as a part of onboarding or create new group(s) to administer Autonomous Recovery Service.

2. Create the required IAM policies for the recovery services at root compartment.

3. From the OCI console, navigate to Identity & Security, and then select the Identity.

4. From the left menu, select the Policies section.

5. To create an IAM policy for Oracle AI Database@AWS for Autonomous Recovery Service usage, complete the following substeps.

   1. To allow Oracle AI Database@AWS to use the Autonomous Recovery Service for backup:

      Allow service database to use organizations-assigned-subscription in tenancy where ALL
      {
          target.subscription.serviceName = 'ORACLEDBATAWS'
          ANY
          {
              request.operation='CreateProtectedDatabase',
              request.operation='ChangeProtectedDatabaseSubscription'
          }
      }

   2. Apply the following policies to grant users in the following groups permission to manage or use Autonomous Recovery Service:

      allow group aws-db-family-administrators to manage recovery-service-family in tenancy
      allow group aws-db-family-administrators to use recovery-service-family in tenancy

Note

Note: The manage permission allows editing Autonomous Recovery Service policies in addition to configuring database backups with Autonomous Recovery Service, whereas the use permission only allows configuring database backups.

If your ODB network is created before Autonomous Recovery Service GA date, then configure network resources for recovery service .

1. From the OCI console, navigate to Exadata VM Clusters, and then select your Exadata VM Cluster.

2. Select the VM Cluster information tab, and then ensure the VM Cluster name on the OCI console matches the intended name.

   

3. From the VM Cluster information page, make a note of the names of the Virtual cloud network, Backup subnet, and Backup network security groups.

4. In the VM Cluster Information tab, right-click the link next to Virtual Cloud Network and open it in a new browser tab.

   1. Navigate to the Subnets tab.

   2. Make sure the IPv4 CIDR block of the backup subnet is at least /24 (256 IP addresses). If it is not, you must create a new subnet with a CIDR block of at least /24.

   

5. Navigate to Oracle Database, and then select Database Backups.

6. From the Recovery Service Subnets section, and then select the Register Recovery Service subnet button.

   1. Enter a descriptive Name for your recovery service subnet.

   2. From the dropdown list, select the Compartment where the recovery service subnet will be created.

   3. Select the Virtual cloud network in compartment from the list.

   4. Select Virtual cloud network used by the VM Cluster and the Backup Subnet.

   5. Expand the Advanced options section, and then enable the Use network security groups to control traffic option.

   6. Select the Backup network security group of the VM cluster that you are using.

   7. Once you complete, select the Register button.

      

   8. If it is successful, the State of Recovery Service subnet will change to Active.

      

7. In the VM Cluster Information tab, right-click the link next to Backup network security groups, and open it in a new browser tab.

   1. Navigate to the Security rules tab.

   2. Add stateful ingress rules to allow access from the entire CIDR range of the VCN where the database resides, permitting all source ports to destination ports 2484 and 8005.

   3. Add egress rules to allow access to destination ports 2484 and 8005 from the full CIDR range of the VCN where the database resides.

      

For more information, see Configuring Network Resources for Recovery Service.