Maintain and Troubleshoot Access

Rotate and Revoke Credentials

Rotate catalog and storage credentials independently. Update a stored username/password credential without recreating each dependent external object:

BEGIN
  DBMS_CLOUD.UPDATE_CREDENTIAL(
    credential_name => 'DATA_STORAGE_CREDENTIAL',
    attribute => 'PASSWORD',
    value => '<new_storage_secret>'
  );
END;
/

Before dropping a credential, inventory external tables, catalog mounts, cache operations, scheduled jobs, and applications that depend on it. Treat signed and pre-authenticated URLs as secrets, constrain their scope and lifetime, and use them only when the selected API supports them.

After validating the replacement identity and removing or updating every dependency, drop the stored credential:

BEGIN
  DBMS_CLOUD.DROP_CREDENTIAL(
    credential_name => 'DATA_STORAGE_CREDENTIAL');
END;
/

This removes only the database-stored credential. Disable a cloud-native principal through the deployment integration and the applicable cloud IAM policy or trust relationship.

Diagnose the Failing Layer

Symptom Likely layer Check
Host cannot be resolved or the connection times out. Network DNS, route, proxy, private endpoint, ACL, and port.
TLS or certificate error. Network trust Endpoint name, certificate chain, wallet, and trusted certificate authorities.
Authentication fails. Credential Credential type, owner, key or token validity, token endpoint, and clock-sensitive token lifetime.
Authentication succeeds but access is denied. External authorization IAM policy, role trust, storage role, bucket policy, namespace, and prefix scope.
Catalog table is visible but its query fails. Data-storage path Storage credential mapping and access to each referenced metadata and data object.
One schema succeeds and another fails. Database-local configuration Credential ownership, local mapping, package privilege, and object grant.

Example: Isolate object-storage access

List a small sample of objects before troubleshooting a catalog-backed table:

SELECT object_name, bytes
FROM DBMS_CLOUD.LIST_OBJECTS(
       'DATA_STORAGE_CREDENTIAL',
       '<object_storage_prefix_uri>')
FETCH FIRST 10 ROWS ONLY;

This test requires provider list permission. If listing is intentionally not allowed, read a known small object instead:

SELECT DBMS_LOB.GETLENGTH(
         DBMS_CLOUD.GET_OBJECT(
           'DATA_STORAGE_CREDENTIAL',
           '<known_small_object_uri>')) AS object_bytes
FROM dual;

GET_OBJECT returns a BLOB, so use a small diagnostic object. These checks isolate the storage credential and endpoint; they do not validate a catalog or token endpoint.

Continue with:

Related documentation: