Set Up Oracle Key Vault for Oracle Base Database Cloud@Customer

Oracle Key Vault is a security-hardened appliance that centralizes the management of encryption keys and other security objects. With Oracle Base Database Cloud@Customer, Oracle Key Vault provides a customer-managed solution for creating, storing, and managing Transparent Data Encryption (TDE) master encryption keys.

Oracle Base Database Cloud@Customer enables you to use Oracle Key Vault as a customer-managed key management solution for Oracle AI Database Transparent Data Encryption (TDE) master encryption keys.

Customer-managed keys help meet security, governance, and regulatory compliance requirements by enabling centralized management, storage, monitoring, and lifecycle management of TDE master encryption keys. Oracle Key Vault also enables you to centrally manage TDE master encryption keys across multiple Oracle AI Database deployments.

A keystore is an Oracle Base Database Cloud@Customer resource that associates a database with an Oracle Key Vault. The keystore enables databases to securely access customer-managed TDE master encryption keys managed by Oracle Key Vault.

To use customer-managed TDE master encryption keys with Oracle Base Database Cloud@Customer, prepare the Oracle Key Vault environment, configure Oracle Base Database Cloud@Customer to communicate with the Oracle Key Vault, and create a keystore associated with the Oracle Key Vault.

With Oracle Key Vault, you can:

Centrally manage TDE master encryption keys across multiple Oracle AI Database deployments.
Switch existing databases from Oracle-managed keys to customer-managed keys.
Rotate CDB and PDB TDE master encryption keys.
Use customer-managed keys with databases configured with or without Oracle Data Guard.

Oracle Key Vault is customer provisioned and customer managed. It is not part of OCI managed services.

Prerequisites

Before configuring Oracle Key Vault for use with Oracle Base Database Cloud@Customer, ensure that the following prerequisite is met:

Pluggable databases (PDBs) must use United Mode.

For more information about United Mode, see Managing Keystores and TDE Master Encryption Keys in United Mode.

Prepare Oracle Key Vault

Before integrating Oracle Key Vault with Oracle Base Database Cloud@Customer, complete the following tasks:

Ensure that the Oracle Key Vault is deployed and accessible from the Oracle Base Database Cloud@Customer client network. Configure outbound network access on ports 443, 5695, and 5696 to enable communication between Oracle Base Database Cloud@Customer and the Oracle Key Vault.
Enable the Oracle Key Vault REST interface.
Create an Oracle Key Vault REST administrator user with the Create Endpoint privilege. You can use any valid user name, for example, okv_rest_user.
Record the Oracle Key Vault REST administrator user name, password, and the Oracle Key Vault IP address. You will use this information when configuring Oracle Base Database Cloud@Customer to communicate with Oracle Key Vault.

For more information, see:

Store the Oracle Key Vault REST Administrator Password

Oracle Base Database Cloud@Customer uses the Oracle Key Vault REST administrator credentials to communicate with the Oracle Key Vault during database provisioning and other Oracle Key Vault operations.

Store the Oracle Key Vault REST administrator password as a secret in OCI Vault. Oracle Base Database Cloud@Customer retrieves the password from OCI Vault only when it needs to communicate with the Oracle Key Vault.

To store the Oracle Key Vault REST administrator password, create a vault and then create a secret in the vault.

For more information, see:

Create an IAM Policy

Create an IAM policy that grants the required user group permission to read the secret bundle containing the Oracle Key Vault REST administrator password stored in OCI Vault.

Use the following policy statement:

Allow group <group-name> to read secret-bundles in compartment <compartment-name> where target.secret.id='<secret_ocid>'

Replace the following placeholders with values for your environment:

<group-name>: The name of the IAM group that requires access to the secret.
<compartment-name>: The compartment that contains the secret.
<secret_ocid>: The OCID of the secret containing the Oracle Key Vault REST administrator password.

For more information, see:

Create a Keystore

A keystore is required to enable Oracle Base Database Cloud@Customer databases to use customer-managed TDE master encryption keys managed by Oracle Key Vault. It stores the Oracle Key Vault connection details and enables databases to access customer-managed TDE master encryption keys.

For instructions, see Create a Keystore.