Plan Authentication and Credential Responsibilities
Separate Credential Roles
| Identity or Credential | Purpose | Minimum scope |
|---|---|---|
| Database identity | Connect to Oracle AI Database and exercise SQL or PL/SQL privileges. | Required schemas, packages, tables, and views. |
| Catalog credential | Authenticate to a catalog and, where required, its token service. | Required catalogs, namespaces, and metadata operations. |
| Data-storage credential | Read or write objects referenced by the definition or catalog. | Required buckets, containers, and prefixes; read-only unless a documented write path is used. |
| Sharing credential | Authenticate to a supported sharing endpoint. | Required shares, schemas, and tables. |
Keep catalog and storage credentials separate unless the provider integration explicitly requires one identity for both.
Select a Provider Authentication Model
The following two authentication models are used:
| Authentication model | Meaning | Configuration |
|---|---|---|
DBMS_CLOUD stored credential |
The portable model. Oracle AI Database stores encrypted provider credential material, such as an access key, account key, auth token, or signing key. | Create and maintain the database credential object with DBMS_CLOUD.CREATE_CREDENTIAL and DBMS_CLOUD.UPDATE_CREDENTIAL. |
| Cloud-native principal authentication | A deployment-provided identity. The Oracle deployment authenticates as a cloud principal instead of using a long-lived provider access key stored in a user-created credential. | Configure the principal and its cloud IAM policy through the target Oracle service and cloud provider. |
Select the provider-specific values as follows:
| Provider | DBMS_CLOUD stored credential | Cloud-native principal authentication |
|---|---|---|
| Oracle Cloud Infrastructure | OCI user name and auth token for supported Object Storage paths, or the OCI signing-key overload when request signing is required. | OCI resource principal supplied by the Oracle deployment. |
| Amazon Web Services | AWS access key ID and secret access key. | AWS IAM role identified by an ARN and assumed through the Oracle deployment’s AWS integration. |
| Microsoft Azure | Storage account name and storage account access key. | Microsoft Entra service principal or managed identity supplied by the Oracle deployment. |
| Google Cloud | HMAC access ID and HMAC secret for the supported object-storage endpoint. | Google Cloud service account supplied by the Oracle deployment. |
| Other object storage | Access key and secret accepted by the supported endpoint. | Use a cloud-native principal only when the target Oracle deployment provides a specific integration for that provider. |
Selection rule - Use cloud-native principal authentication only when the target Oracle deployment and the selected lakehouse operation explicitly support that principal. Otherwise, use a DBMS_CLOUD stored credential.
For details about stored-credential procedures and parameters, see DBMS_CLOUD.
For Autonomous AI Database examples of cloud-native principal configuration, see: