Installing Oracle Database Security Central on Amazon Web Services (AWS)

Install the AWS command line interface (CLI).

See Installing or updating to the latest version of the AWS CLI and Setting up the AWS CLI from the AWS documentation for more information.
Create a S3 bucket.

See Create your first S3 bucket from the AWS documentation for more information.
Create a vmimport user and assign it the necessary policies for import.

See Required permissions for VM Import/Export from the AWS documentation for more information.
Upload the DBSecCentral image to the S3 bucket.
```
aws s3 cp <your/path/to/image> s3://<your-bucket-name>/<image-name.vhd>
```
The DBSecCentral image files, avs.vhd and dbfw.vhd, can be found from Oracle Software Delivery Cloud as part of the Audit Vault Server on AWS and Database Firewall on AWS downloads, respectively. You will have to unzip the provided files. See Downloading the Oracle Database Security Central Software for more information.

See the cp entry in the AWS CLI documentation for more information.

Create a container.json file containing the following:

{
    "Description": "DBSecCentral_AWS_IMAGE",
    "Format": "vhd",
    "UserBucket": {
        "S3Bucket": "DBSecCentral-images",
        "S3Key": "<DBSecCentral_AWS.vhd>"
    }
}

Ensure that you change the name of the DBSecCentral image file as necessary.

Create a snapshot from the image file in the S3 bucket. Use the container.json file created in the previous step.

See Importing a disk as a snapshot using VM Import/Export from the AWS documentation for more information.
Create an Amazon Machine Image (AMI) using the snapshot.

See Create an AMI from a snapshot from the AWS documentation for more information.

For the Virtualization type, select hardware virtual machine (HVM).

For the Boot mode, select legacy-bios.
Launch the instance from the AMI image.

See Launch an EC2 instance using the launch instance wizard in the console from the AWS documentation for more information.

Ensure the following:
- Use, at minimum, an c5.xlarge with vCPU: 4 and Memory: 8Gb instance
- For SSH key pairs, generate a ed25519 key
- If using a security group, allow imports from port 22 for SSH and ports 7443 and 443 for HTTP.
Perform the steps in Post Instance Creation Steps
- Audit Vault Server:
  1. Log in to the appliance through SSH and switch to the root user.
  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using AWS instance console connection.
```
sudo passwd root
```
  3. Generate a one time passphrase by running the command:
```
sudo -u oracle /usr/local/dbfw/bin/generate_post_install_passphrase.py
```
  4. Copy the passphrase that is returned by the above command.
  5. Access the Audit Vault Server console by entering https://<IP address of the instance> as the URL in the browser.
  6. Enter the passphrase copied from the earlier step in the Post Install Authentication page of the Audit Vault Server console.
  7. Fill in the details in the Post Install Configuration page.
  8. In the AVS IP for Agent Communication section, specify the public IP of the Audit Vault Server if you are expecting to collect audit data from any target outside of AWS. See section Deploying Audit Vault Agents for more details.
    
    Note: After the post installation step is complete, changing the AVS IP for Agent communication is not supported.
  9. Select Save.
    
    DNS is automatically set to 169.254.169.254.
    
    See Also: DNS in Your Virtual Cloud Network
- Database Firewall:
  1. Log in to the appliance through SSH and switch to the root user.
  2. Change root user password by running the following command. The root password is required to troubleshoot the instance using AWS instance console connection.
```
sudo passwd root
```
SSH into the instance:
1. Copy the downloaded AWS_SSH.pem file to ~/.ssh/ folder
```
cp AWS_SSH.pem  ~/.ssh/
```
2. Run the following command:
```
ssh -i  "~/.ssh/AWS_SSH.pem" opc@<<ip address>>
```

Related Topics