Configure Connectivity and Database Access

Configure Outbound Network and TLS

Configure connectivity to the exact hosts used by the access path. File access requires the object-storage endpoint. A catalog-backed path can additionally require a catalog endpoint, OAuth or token endpoint, and a different object-storage endpoint.

Depending on the deployment, configure DNS, routing, HTTPS, network access control lists, proxy settings, private endpoints or service gateways, and the required certificate trust or wallet. Grant network access only to the required hosts and ports; HTTPS endpoints normally use port 443.

The following example grants one database user outbound HTTPS access to one catalog or object-storage host:

BEGIN
  DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
    host => '<catalog_or_storage_host>',
    lower_port => 443,
    upper_port => 443,
    ace => xs$ace_type(
      privilege_list => xs$name_list('http'),
      principal_name => '<database_user>',
      principal_type => xs_acl.ptype_db
    )
  );
END;
/

Repeat the grant for each required catalog, token, and object-storage host. If the deployment routes requests through an HTTP proxy, grant the required proxy access separately according to the network configuration for that deployment.

Test connectivity from the database environment. Success from a workstation does not prove that the database can reach the endpoint.

For details about network ACL grants for DBMS_CLOUD users, see Configure Access Control Entries for DBMS_CLOUD.

Grant Least-Privilege Database Access

Use a dedicated role and grant only the capabilities required for the workflow. A typical query-only owner needs CREATE SESSION, execute permission on the required package, permission to create an external table only when it owns the definition, and access to any directory object required by the chosen driver. Application users usually need SELECT on curated tables or views, not package-administration privileges.

Catalog administrators, external-table owners, and application readers are different roles. Do not use a deployment-specific administrative role in portable examples.

Example: Separate Owner and Reader Privileges

-- Run as a privileged administrator in the target PDB.
CREATE ROLE lakehouse_external_owner;

GRANT CREATE TABLE
TO lakehouse_external_owner;

GRANT EXECUTE ON DBMS_CLOUD
TO lakehouse_external_owner;

GRANT lakehouse_external_owner
TO <external_table_owner>;

GRANT CREATE SESSION
TO <external_table_owner>;

-- Run after the owner creates the curated object.
GRANT SELECT ON <external_table_or_view>
TO <application_reader>;

CREATE TABLE is required only for a schema that creates external-table definitions. Assign any required tablespace quota directly to that schema. Grant DBMS_CATALOG execution only to users that administer mounted catalogs. Definer-rights PL/SQL can require package and object privileges to be granted directly rather than through a role.

For details about the minimum database grants required for DBMS_CLOUD, see Grant Minimal Privileges for DBMS_CLOUD.