Protect Exadata Database

You must first complete the registration required for delegated subnets to use the advanced network features mentioned in Network planning for Oracle AI Database@Azure, and then create an Azure Virtual Network with one delegated subnet to be used by the Exadata VM Cluster.

For step-by-step instructions, see the CMK - AKV tab in the Prerequisites section.

For step-by-step instructions, see the CMK - AKV tab in the Prerequisites section.

For step-by-step instructions, see Exadata VM Cluster.

1. From the Azure portal, select Key vaults.
2. Select the Name field of the Key vault that you want to use.
3. Expand the Settings section, and then select Networking.
4. From the Firewalls and virtual networks tab, choose the Disable public access option.
   Note
   
   After the public access is disabled, Azure Key Vault is accessible only through a Private Endpoint.
5. Select the Apply button to save the changes.

1. From the OCI console, select Oracle AI Database, and then select Oracle Exadata Database Service on Dedicated Infrastructure .
2. From the left menu, select Exadata VM Clusters and then select your Exadata VM Cluster.
3. Select the Databases tab and then select the database that you are using.
4. Navigate to Network section, and then select Virtual Cloud Network.
5. From the Details tab, select DNS Resolver link.
6. From the Private resolvers page, select the Default private view link..
7. In the Private view page, select the Private zones tab.
   Note
   
   If the DNS Zone already exists in your environment, add the record to your existing Private Zone.
8. In the Private Zones section, select the Create zone button to create the first private zone.
   1. The Zone type field is set to Primary by default.
   2. Enter a descriptive Zone name. Select the zone name that matches the domain FQDN copied in the previous step. For example, vault.azure.net.
   3. From the dropdown list, select the Compartment in which you want to create a private zone.
   4. The Tags section is optional.
   5. Select the Create.
   6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
   7. Select the Manage records button.
   8. From the Manage records page, select the Add record button.
      1. For the Name field, enter the FQDN name that you previously noted.
      2. Select the A- IPv4 address option as your Type.
      3. Adjust the TTL in seconds based on your requirements.
      4. Select your RDATA mode.
      5. In the Address field, enter the IP address that you previously noted , then select the Save changes button.
   9. Select the Review changes button, then select the Publish Changes button.
9. To create a second zone, select the Create zone button.
   1. The Zone type field is set to Primary by default.
   2. In the Zone name field, enter a zone name based on your Private DNS Zone domain. For example, privatelink.vaultcore.azure.net.
   3. From the dropdown list, select the Compartment in which you want to create a private zone.
   4. The Tags section is optional.
   5. Select the Create button.
   6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
   7. Select the Manage records button.
   8. From the Manage records page, select the Add record button.
      1. For the Name field, enter your Azure Private zone record set name.
      2. Select the A- IPv4 address option as your Type.
      3. Adjust the TTL in seconds based on your requirements.
      4. Select your RDATA mode.
      5. In the Address field, enter the IP address that you previously noted, then select the Save changes button.
   9. Select the Review changes button, then select the Publish Changes button.

To create an Identity Connector over a private network, you must configure an Azure Arc Private Link Scope and a Private Endpoint through the Azure Portal.

1. Create Azure Arc Private Link Scopes
   1. From the Azure portal, navigate to Azure Arc.
   2. Expand the Additional setup section, and then select Private link scopes.
   3. Select the + Create button to start the creation process.
   4. From the Basics tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
      1. Select the Subscription that you want to use, and then select the Resource group.
      2. Enter a descriptive Name for the private link scope. The private link scope name can contain only alphanumeric characters and the following symbols: hyphen (-), period (.) , and underscore (_). The name can not begin with underscore (_) or end with period (.) or hyphen (-).
      3. Select the Region.
      4. Select the Next: Private endpoint > button to proceed.
   5. From the Private endpoint tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
      1. Select the + Create button to create a private endpoint.
      2. The Subscription field populates automatically.
      3. Select the Resource group.
      4. For the Location field, select the region corresponding to your Exadata VM Cluster deployment.
      5. Enter a descriptive Name for your private endpoint. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
      6. From the Networking section, select your Virtual network and Subnet.
      7. Choose the Yes option to integrate with private DNS zone. This automatically creates a new private DNS zone.
      8. Select the OK button.
      9. Select the Next: Tags > button to proceed.
   6. The Tags section is optional. To manage and create custom views of your resources, assign tags. Select the Next: Review + create > button.
   7. Once you review your information, select the Create button.
2. Obtain Azure Arc Private Link DNS Zones Information
   1. From the Azure portal, navigate to Private endpoints.
   2. Expand the Private link section, and then select Private endpoints.
   3. Select your private endpoint from the list and then expand the Settings section.
   4. Select the DNS configuration.
   5. Take a note of the FQDN and IP addresses information.
   Note
   
   The DNS configuration for the Private Endpoint associated with the Private Link Scope must include the necessary private agent resource addresses. For more information, see URLs.
3. Create OCI Private Zone
   1. From the OCI console, select Oracle AI Database and then select Oracle Exadata Database Service on Dedicated Infrastructure. Select the name of your Exadata VM Cluster.
   2. Scroll down to the Network section, then select the Virtual Cloud Network.
   3. In the VCN information section, under DNS Resolver, select DNS Resolver Name.
   4. From the Private Resolver section, select the Default Private view name.
   5. In the Private view page, select Private zones tab.
   6. From the Private zones page, select the Create zone button to create the first private zone.
      1. In the Zone name, select the name according with your domain FQDN which you copied in the previous step. For example, arc.azure.com).
      2. Select the Create button.
      3. Select the name field of the zone that you created in the previous step.
      4. Select the Records tab, and then select Manage records button.
      5. Select the Add record button.
         1. For the name field, paste your FQDN name. For example, gbl.
         2. Select A- IPv4 address as your type.
         3. In the Address field, enter the IP addresses that you copied in the previous step. Then, select the Save changes button.
      6. Select the Review changes button, then select Publish Changes button.
      7. Repeat the previous step until you have added all records to the specified Private Zone.
      
   7. Create all the Private zones, and add the records obtained from the Obtain Azure Arc Private Link DNS Zones Information step.
      Note
      
      Even with Private Connectivity, the following endpoints must be routed through the Azure NAT gateway.

      Agent resources:

      • packages.microsoft.com
      • login.microsoftonline.com
      • pas.windows.net
      • management.azure.com

      You must ensure the connectivity to these endpoints. Otherwise, the Identity Connector creation will fail.

4. Create a NAT Gateway in Azure Portal
   1. From the Azure Portal, select NAT Gateways.
   2. Choose the Subscription that you want to use, then select the Resource group.
   3. Enter a name for your NAT gateway, select the Region corresponding to your VNET, then select the Next button.
   4. In the Outbound IP tab, select the Add Public IP addresses or prefixes button.
      1. You can select an existing public IP address or prefix or both to associate with the NAT gateway and enable outbound connectivity.
         1. To create a new public IP for the NAT gateway, select the Create a public IP address button. Enter a Name, and then select the OK button.
         2. To create a new public IP prefix for the NAT gateway, select the Create a new public IP prefix button. Enter a Name, select a Prefix size, then select the OK button.
      2. Once you enter your information, select the Next button.
   5. In Networking tab, select your Virtual Network, then select the subnet that you want to associate the NAT gateway.
   6. Select the Review + Create button, and then select the Createbutton.

Creating an Identity Connector installs the Azure Arc agent on the Exadata VM Cluster VMs, registering them as Azure Arc-enabled virtual machines.

This enables secure communication with the Azure Key Management Service (KMS) using the Azure identity generated by the Arc agent. The Azure Arc agent can communicate with Azure services over either a public network or a private connectivity setup. For more information, see Azure Arc.

Each Exadata VM Cluster must have an identity connector enabled to access Azure resources. The identity connector establishes either a public or private connection between the Exadata VM Cluster and Azure Key Management resources, depending on the roles assigned.

1. Generate an Access Token for your Azure Account
   1. From the Azure Portal, select the Cloud shell button.
   2. In the Cloud Shell, run the following command. Replace <Azure_subscription_ID> with your actual Azure Subscription ID.

      az account get-access-token --subscription <Azure_subscription_ID>

   3. The command will return a JSON object similar to the example below. Take a note of the accessToken value as it is required for the next steps.

      {
        "accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJ................yrdbX3l8B0IxzgvXdQ",
        "expiresOn": "2026-03-25 14:35:43.000000",
        "expires_on": 1774449343,
        "subscription": "641531f9-2e12-430b-be35-0d8eba8d957c",
        "tenant": "6798aca3-9d44-4ba7-8a36-39770fe4ab9e",
        "tokenType": "Bearer"
      }

   
   Note
   
   To see more information about access token, see az account get-access-token.
2. Create an Identity Connector
   1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Dedicated Infrastructure.
   2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
   3. From the Multicloud information section, scroll down to the Identity connector section, and then select the Create button.
   4. From the Create identity connector page, enter the following information.
      1. Enter the Azure Tenant id.
      2. Paste the Access token that you copied in the previous step.
      3. Expand the Advanced Options menu, then enter the name of your Azure Arc Private Link Scope that you previously created.
      4. Review your information and then select the Create button.
      
3. Validate the Identity Connector Status
   1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Dedicated Infrastructure.
   2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
   3. In the VM Cluster information tab, locate the Multicloud information section. Under Identity connector, select the Identity connector link. This will redirect you to the Identity Connector Information page, where you can verify the status. Ensure that the status is shown as Active.
   

he database uses the cluster resource principal to securely retrieve Azure Cloud key resources. To enable this functionality, you must define the appropriate IAM policies in your OCI tenancy.

To create the appropriate IAM policies, complete the following steps.

1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Dedicated Infrastructure.
2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
3. In the VM Cluster information tab, scroll down to the General information section and take a note of the Compartment information.
4. From the left menu , select Identity & Security, and then select Compartments.
5. Locate the Compartment that you previously recorded. From the Details tab, take a note of the compartment OCID information.
6. From the left menu , select Identity & Security, and then select Policies. Select the Create Policy button.
   1. Enter a policy Name.
   2. Select the root compartment.
   3. Select the show manual editorbutton, paste the following policy, and replace the <your-compartment-OCID> with the compartment OCID that you previously copied.

      
      allow any-user to manage oracle-db-azure-vaults in compartment id <your-compartment-OCID>  where ALL { request.principal.type in ('cloudvmcluster') }
      
      

   4. Select the Create button.
   Note
   
   To implement Cross-Region Data Guard with Azure Key Vault (AKV) as your encryption method, you must configure the following additional policies:

   
   allow any-user to read oracle-db-azure-keys in compartment id <your-compartment-OCID> where ALL { request.principal.type in ('cloudvmcluster') }
   allow any-user to manage db-multi-cloud-family in compartment id <your-compartment-OCID> where ALL { request.principal.type in ('cloudvmcluster') }

1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Dedicated Infrastructure.
2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
3. In the VM Cluster information tab, scroll down to the Azure key management section, and select the Enable button. The confirmation message appears, select the Enable button to confirm it.
   Note
   
   

   • When you provision an Exadata VM Cluster, Azure key management is disabled by default.
   • If you do not want to use Azure key management, you can disable it by selecting the Disable button. This action will disable Azure key management at the VM Cluster level. Disabling it will impact the availability of the databases using Azure key management. Ensure that no database is currently using Azure key management.
   • Azure key management is configured at the VM cluster level, requiring all databases in the cluster to use the same key management solution. However, databases that use Oracle Wallet can coexist alongside those that use Azure Key Vault within the same VM cluster.

1. Create a Azure Group in Microsoft Entra ID
   1. In the Azure portal, select Microsoft Entra ID.
   2. From the left menu, select Groups, and then select the New Group button.
   3. From the New Group page, enter the following information.
      1. Group type: Security
      2. Group name: Enter a descriptive name in the field.
      3. Group description: Enter a description in the field.
      4. Membership type: Assigned
      5. Review your information and then select the Create button.
      
   4. From the Azure portal, select Microsoft Entra ID and then select Groups.
   5. Locate the group name that you previously created and then select it.
      1. In the Group Memberships section, select the View group members link.
      2. Select the + Add member button.
      3. Add the Azure Arc name of each node of your Exadata VM Cluster node, then choose the select button.
      
2. Assign Permission to the Azure Key Vault
   1. From the Azure portal, select Key vaults and then select the Key vault that you want to use.
   2. From the left menu, select Access control (IAM).
   3. Select the + Add button, then select the Add role assignment option.
   4. From the Role tab, search for the Reader role, then select the Next button.
   5. In the Members tab, select the User, group, or service principal option, then choose the Select members link.
   6. Search for the Group Name that you previously created. It contains the Azure Arc Names of your Exadata VM Cluster nodes, then choose the Select button.
   7. Review your information and then select the Review + assign button.
   8. Repeat the step to assign the Key Vault Crypto Officer role.
      Note
      
      The Reader and Key Vault Crypto Officer roles must be assigned to the group to grant the necessary permissions to access and manage Azure Key Vault Premium and Azure Key Vault Standard resources.
3. Validate the Key Vault Permissions
   1. From the Azure portal, select Key vaults and then select the Key vault that you want to use.
   2. From the left menu, select Access control (IAM).
   3. From the Check access section, select the Check access button.
   4. Search for your Azure Arc Group name that you previously created, then select the Group Name.
   

To enable Azure key management for your Exadata VM Cluster, you must first register your Azure Key Vault in the OCI Console

1. From the OCI Console, select Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select Microsoft Azure Integration, then select Azure Key Vaults.
3. Select the Register Azure key vaults button, and then complete the following substeps.
   1. From the dropdown list, select the Compartment in which your Exadata VM Cluster resides.
   2. Select your identity connector from the dropdown list.
   3. The Key Vault Name field is optional.
   4. Select the Discover button.
4. Once the key is discovered, select the Key vault checkbox, then select the Register button to register the key in OCI.
   Note
   
   Ensure the Azure Key Vault contains at least one valid key. Otherwise, the discovery process will not return any information.

1. Complete the following steps described in the Create Exadata Database documentation to create an Exadata Database.
2. Navigate to the Encryption section which provides two options. These options include Oracle Wallet and Azure Key Vault.
3. Select the Azure Key Vault as the key management. Select the Compartment and the Azure Key Vault from the dropdown list, then select the Key from the dropdown list.
4. Review your information, and then select the Create button.

To update key management from Oracle Wallet to Azure Customer-Managed Key, complete the following steps:

1. From your Exadata VM Clusters, navigate to Databases tab, and then select the database that you are using.
2. From the Encryption section, confirm that Key management is set to Oracle Wallet, and then select the Change button.
3. From the Change key management page, enter the following information.
   1. Select your Key management as Azure Key Vault from the dropdown list.
   2. Select the key compartment you are using, and select the desired Azure Key Vault from the dropdown list, then select the key from the dropdown list.
   3. Select the Save changes button.
   

1. From Azure Portal, select Oracle AI Database@Azure.
2. From the left menu, select Oracle Exadata Database Service on Dedicated Infrastructure, and then select the Oracle Exadata VM Cluster tab. Select the name of your Exadata VM Cluster.
3. Select the name of your Exadata VM Cluster from the Essential section.
4. Select the Go to OCI link which redirects you to the OCI Console.
5. In the OCI Console, select the Databases tab, and then select the database that you want to check the key management.
6. From the Database information tab, navigate to the Encryption section. Verify that the Key management is set to Azure Key Vault with the Vault and Key used in the encryption process.

1. From the OCI Console, select Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select Microsoft Azure Integration, then select Azure Key Vaults
3. Select the name of the Azure Key Vault that you want to use, and then select the Actions button. From the dropdown list, select the Replicate Azure Key Vault option.
4. From the Destination region dropdown list, select the region where you wish to replicate the key ring, then select the Replicate button.
5. Once the process is complete, navigate to the Cross-region replications tab. Ensure the key ring appears as Active within the specific region you selected for replication.

1. From the Azure portal, select Key vaults and then select the Name field of the key vault that you replicated in the previous step.
2. Expand the Settings section, and then select Networking.
3. Select the Private endpoints connections tab, then select the Create button.
4. From the Create a private endpoint page, complete the following substeps:
   1. In the Basics tab, enter the following information.
      1. Choose the Subscription that you want to use, then select the Resource group.
      2. Enter a descriptive Name for your private endpoint.
      3. Enter a descriptive name in the Network Interface Name field.
      4. Select a Region (Standby) from the dropdown list.
      5. Select the Next: Resource > button.
      
   2. In the Resource tab, enter the following information.
      1. Choose the Connect to an Azure resource in my directory option as your Connection method.
      2. Choose the Subscription that you wish to use.
      3. Select Microsoft.KeyVault/Vaults as your Resource type.
      4. From the Resource dropdown list, select the key that you wish to use and replicate .
      5. Select your Target sub-resource.
      6. Select the Next: Virtual Network > button.
      
   3. In the Virtual Network tab, enter the following information.
      1. From the dropdown list, select the Virtual network in your standby region.
      2. From the dropdown list, select the Subnet where you want to deploy your private endpoint.
      3. Choose the Dynamically allocate IP address option from the Private IP configuration.
      4. Select the Next: DNS > button.
      
   4. In the DNS tab, enter the following information.
      1. Choose the Yes option from the Integrate with private DNS zone section.
      2. Select your Subscription and Resource group.
      3. Select the Next: Tags > button.
      
   5. In the Tags tab, you can enter Key and Value information. This section is optional. Select the Next: Review + create > button.
   6. In the Review + create tab, review your information, and then select the Create button.

1. From the Azure portal, select Key vaults and then select the Name field of the key vault that you replicated in the previous step.
2. Expand the Settings section, and then select Networking.
3. Select the Private endpoints connections tab, then select name field of the Private endpoint that you previously for the Standby region.
4. From the left menu, expand the Settings section, and then select DNS configuration. Take a note of the FQDN and IP addresses information.

Complete the steps outlined in the step 7 to add the Private Azure Key Vault DNS Zones, using the Standby Endpoint information that you previously obtained.

For step-by-step instructions to configure Oracle Data Guard on an Exadata Database, see Configure Oracle Data Guard on Exadata Database in Oracle AI Database@Azure.