Troubleshooting Customer-Managed KMS Key Issues for an SCM-Created Autonomous Database

If the work request to change the encryption key for an SCM-created Autonomous Database fails, use the following steps to troubleshoot customer-managed KMS key issues:

1. Review the work request error. Record the ATP OCID, work request OCID, timestamp, selected key, and selected Vault.
2. Verify that the ATP database is in the AVAILABLE lifecycle state.
3. Verify that the Vault is active.
4. Verify that the master encryption key is enabled in the expected region and compartment.
5. Verify that the dynamic group rule identifies the existing ATP database.

   If the rule uses a defined tag, verify that the tag uses the correct namespace, key, and value.

6. Verify that the active policy grants the dynamic group use vaults and use keys permissions in the compartment that contains the selected Vault and key.
7. Allow the documented propagation time to complete if a dynamic group rule or matching tag was changed.
8. Retry the key-change operation on the same ATP database. You don’t need to create another database or rerun the completed Siebel CRM deployment only to retry the KMS operation.

Note: You must keep the selected customer-managed key enabled after the database is configured to use it. If the key is disabled or deleted, the database can become inaccessible. Manage the key according to your organization’s key management policy.