Protect Exadata Database

There is currently no content for this page. The Oracle Database@AWS team intends to add content here, and this placeholder text is provided until that text is added.

The Oracle Database@AWS team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.

Oracle Exadata Database Service on Dedicated Infrastructure on Oracle Database@AWS supports integration with AWS Key Management Service (KMS). This capability allows users to manage Transparent Data Encryption (TDE) master encryption keys (MEKs) using AWS customer managed keys.

For Oracle Exadata Database Service on Dedicated Infrastructure on Oracle Database@AWS, TDE MEKs can be stored in a file-based Oracle Wallet, Oracle Cloud Infrastructure (OCI) Vault, Oracle Key Vault (OKV), or AWS KMS, providing options to align with organization-specific security policies. Integration with AWS KMS enables applications, AWS services, and databases on Exadata VM Cluster (s) to leverage a single centralized key management solution.

1. Create or Verify OCI Identity Domain
   OCI identity domain is a prerequisite before using AWS KMS as the key management solution for your databases. OCI identity domain acts as the identity provider, authenticating the database to allow access to AWS KMS.

   Note
   
   AWS KMS integration is generally available (GA) to Oracle Database@AWS customers starting November 18, 2025. If you completed the onboarding steps after AWS KMS integration became GA, the OCI identity domain has already been created for you. Follow the Verify OCI Identity Domain steps to confirm its existence. Otherwise, follow the Configure OCI Identity Domain steps to complete this prerequisite.
   • Verify OCI Identity Domain
     1. From the AWS console, select Oracle Database@AWS, and then select Settings.
     2. Ensure that OCI identity domain Status is Available.
   • Configure OCI Identity Domain
     1. From the AWS console, select Oracle Database@AWS, and then select Settings.
     2. Select the Configure button. A confirmation message will appear as Successfully initiated the configuration of OCI identity domain.
     3. Verify that the OCI identity domain Status is updated to Available. You can also view additional information including OCI identity domain ID and OCI identity domain URL.
2. Enable Security Token Service and AWS KMS in ODB Network

   To use AWS KMS for data-at-rest encryption, the ODB network must have both Security Token Service (STS) and AWS KMS integrations enabled. For more information, follow the Create ODB Network or Modify ODB Network steps.

3. Configure Identity Provider
   To complete the identity provider configuration, complete the following steps.

   1. From the Oracle Database@AWS dashboard, select Exadata VM clusters, and then select your Exadata VM Cluster corresponding to Exadata Database that you want to enable AWS KMS for.
   2. On the VM Cluster details page, select the IAM service roles tab, and then select the CloudFormation link. This will open the AWS Quick create stack page in a new tab, pre-populated with the required setup information.
   3. From the Quick create stack page, the pre-populated information such as Stack name, OCI Identity Domain URL, OIDCProviderArn, ResourceOcid and RoleName. Accept the I acknowledge that AWS CloudFormation might create IAM resources with customer names checkbox, and then select the Create stack button.
      Note
      
      The CloudFormation stack creates an OIDC ((OpenID Connect)) Provider and an associated IAM role. OIDC Provider is unique per account.

      • If you are executing the stack for the first time, do not need to provide a value for the OIDCProviderArn field.
      • For any additional execution time, you must provide the ARN of the existing OIDC Provider and specify it in the OIDCProviderArn field. To obtain your existing OIDC Provider ARN in your AWS account, complete the following steps.
        1. From the AWS console, navigate to IAM, and then select Identity providers.
        2. From the Identity providers list, you can filter your provider selecting Type as OpenID Connect.
        3. Select the Provider link that was created when the CloudFormation stack was initially created.
        4. From the Summary page, copy the ARN information.
        5. Paste the ARN information into the OIDCProviderArn field.
      • The OIDC Provider and IAM role will be used by Oracle Database to access AWS KMS keys for encryption and decryption. The role provides OCI resource level isolation.
      • If the isolation for database resources is not required, ResourceOcid and RoleName values should be left blank.
      
   4. After the CloudFormation stack deployment is complete, navigate to the Resources section of the stack and Verify that the IdP and IAM Role resources were created. Copy IAM Role ARN for the next steps.
4. Associate an IAM Role to an Exadata VM Cluster

   Complete the following steps to associate the IAM role to an Exadata VM Cluster. This step will create an identity connector that allows access to the AWS resources.

   1. From the AWS console, select Oracle Database@AWS.
   2. From the left menu, select Exadata VM clusters, and then select your Exadata VM Cluster from the list.
   3. Select the IAM roles tab, and then select the Associate button.
      1. The AWS integration field is read-only.
      2. Enter the Amazon Resource Name (ARN) of the IAM role you want to associate with Exadata VM Cluster in the Role ARN field. You can obtain the ARN information from the Summary section of the role that you previously created.
      3. Select the Associate button to attach the role.
      
   4. After the associate process is complete, the Service role ARN Status will change to Associated.
      Note
      
      Once you associate an IAM role to your Exadata VM Cluster, an identity connector gets attached to it.
5. Create a Customer Managed Key
   1. From the AWS console, select Key Management Service (KMS).
   2. From the left menu, select Customer managed keys, and then select the Create key button.
   3. In the Configure key section, enter the following information.
      1. Choose the Symmetric option as the Key type.
      2. Choose the Encrypt and decrypt option as the Key usage.
      3. Expand the Advanced options section. Both AWS KMS and AWS CloudHSM are supported.
         1. If you want to use KMS, choose the KMS - recommended option as Key material origin, and then choose either the Single-Region key or the Multi-Region key option from the Regionality section.
            Note
            
            Cross-region Data Guard and restoring databases to a different region are currently not supported for databases that use AWS customer managed keys for key management.
         2. If you want to use AWS CloudHSM , choose the AWS CloudHSM key store option as Key material origin.
      4. Select the Next button to continue the creation process.
      
   4. In the Add labels section, enter the following information.
      1. Enter a descriptive display name in the Alias field. Maximum 256 characters. Use alphanumeric and '_-/' characters.
         Note
         
         

         • The alias name cannot begin with aws/. The aws/ prefix is reserved by AWS to represent AWS managed keys in your account.
         • An alias is a display name that you can use to identify the KMS key. We recommend that you choose an alias that indicates the type of data you plan to protect or the application you plan to use with the KMSkey
         • Aliases are required when you create a KMS key in the AWS console.
      2. The Description field is optional. You can enter a brief description of the key.
      3. The Tags section is optional. You can use tags to categorize and identify your KMS keys and help you track your AWS costs.
      4. Select the Next button to continue the creation process.
      
   5. In the Define key administrative permissions section, complete the following substeps.
      1. Search the role that you previously created, and then select the checkbox. Select the IAM users and roles that can administer the KMS key.
         Note
         
         This key policy gives the AWS account full control of this KMS key. It allows account administrators to use IAM policies to give other principals permission to manage the KMS key.
      2. From the Key deletion section, the Allow key administrators to delete this key checkbox is selected by default. To prevent the selected IAM users and roles from deleting the KMS key, you can deselect the checkbox.
      3. Select the Next button to continue the creation process.
      
   6. In the Define key usage permissions section, complete the following substeps.
      1. Search the role that you previously created, and then select the checkbox.
      2. Select the Next button to continue the creation process.
      
   7. In the Edit key policy section, complete the following substeps.
      1. From the Preview section, you can review the key policy. If you want to make a change, select the Edit tab.

         {
             "Version": "2012-10-17",
             "Statement": [
                 {
                     "Sid": "KMSKeyMetadata",
                     "Effect": "Allow",
                     "Principal": {
                         "AWS": "<arn>"
                     },
                     "Action": [
                         "kms:DescribeKey"
                     ],
                     "Resource": "*"
                 },
                 {
                     "Sid": "KeyUsage",
                     "Effect": "Allow",
                     "Principal": {
                         "AWS": "<arn>"
                     },
                     "Action": [
                         "kms:Encrypt",
                         "kms:Decrypt"
                     ],
                     "Resource": "*"
                 }
             ]
         }

      2. Select the Next button to continue the creation process.
   8. In the Review section, review your information, and then select the Finish button.
6. Register AWS KMS Key
   To enable AWS KMS for your Exadata VM Cluster, you must first register the AWS KMS key in the OCI console.

   1. From the OCI console, select Oracle AI Database, and then select Database Multicloud Integrations.
   2. From the left menu, find AWS Integration, and then select AWS Keys.
   3. Select the Register AWS keys button, and then complete the following substeps.
      1. From the dropdown list, select the Compartment in which your Exadata VM Cluster resides.
      2. Under the AWS keys section, select your identity connector from the dropdown list.
         Note
         
         Ensure that the role associated with the connector has the DescribeKey permission on the key. This permission is required to successfully perform discovery.
      3. The Key ARN field is optional.
      4. Click the Discover button.
   4. Once the key is discovered, select the Register button to register the key in OCI.
7. Enable AWS Key Management
   1. From the OCI console, select Oracle AI Database and then select Oracle Exadata Database Service on Dedicated Infrastructure.
   2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
   3. Select the VM Cluster information tab, and select the Enable button next to AWS key management.
      Note
      
      If you do not want use AWS key management, you can disable it by selecting the Disable button. This action will disable AWS key management at the VM Cluster level. Disabling it will impact the availability of the databases using AWS key management. Ensure that no database is currently using AWS key management.
8. 1. Use AWS KMS as the Key Management Solution During Database Creation
      Note
      
      To see the key at Exadata VM Cluster level, you must run the following policy.

      Allow any-user to read oracle-db-aws-keys in compartment id <your-compartment-OCID> 
      where all { request.principal.type = 'cloudvmcluster'}

      1. Complete the following steps described in the Exadata Database documentation to create an Exadata Database.
      2. Navigate to the Encryption section which provides two options. These options include Oracle Wallet and AWS Customer Managed Key.
      3. Select the AWS Customer Managed Key as the key management. Select the Compartment and the Key from the dropdown list.
      4. Review your information, and then select the Create button.
   2. Use AWS KMS as the Key Management Solution During Database Modification
      Note
      
      To see the key at Exadata VM Cluster level, you must run the following policy.

      Allow any-user to read oracle-db-aws-keys in compartment id <your-compartment-OCID> 
      where all { request.principal.type = 'cloudvmcluster'}

      To update key management from Oracle Wallet to AWS KMS, complete the following steps:

      1. From your Exadata VM Clusters, navigate to Databases tab, and then select the database that you are using.
      2. From the Encryption section, confirm that Key management is set to Oracle Wallet, and then select the Change button.
      3. From the Change key management page, enter the following information.
         1. Select your Key management as AWS Customer Managed Key from the dropdown list.
         2. Select the key compartment you are using, and then select the desired key from the dropdown list.
         3. Select the Save changes button.

AWS Customer Managed Key allows you to rotate the key at both Container Database (CDB) and Pluggable Database (PDB) levels to meet your security compliance requirements. Complete the following steps to rotate the key:

1. 1. Rotate the AWS KMS Key of a Container Database (CDB)
      1. From the OCI console, select Oracle AI Database and then select Oracle Exadata Database Service on Dedicated Infrastructure.
      2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster that you want to rotate encryption keys.
      3. Select the Databases tab, and then select the name of the database that you want to rotate encryption keys.
      4. From the Encryption section, verify that the Key Management is set to AWS key management, and then select the Rotate button.
      5. Select the Confirm button to save the changes.
   2. Rotate the AWS KMS Key of a Pluggable Database (PDB)
      1. From the OCI console, select Oracle AI Database, and then select Oracle Exadata Database Service on Dedicated Infrastructure.
      2. Select your Exadata VM Cluster, and then select Databases tab.
      3. Select the Name field of your database you are using, then select Pluggable Databases link under the Resources section.
      4. Select the Name field of the Pluggable Database you want to use.
      5. The Encryption section displays that the Key management is set as AWS key management. Select the Rotate button, and then select the Confirm button to save the changes.