B Zero Downtime Migration Encryption Requirements
Zero Downtime Migration does not always require encryption at the source (although, all Cloud databases are encrypted by default). The following tables list specific cases when encryption is not required.
Table B-1 On-Premises Unencrypted Primary and Cloud Encrypted Standby
| Operation | On-Premises Primary 11g R2 | Cloud Standby 11g R2 | On-Premises Primary 12c R1 | Cloud Standby 12c R1 | On-Premises Primary 12c R2 | Cloud Standby 12c R2 and later | Notes |
|---|---|---|---|---|---|---|---|
| Data Guard initial setup for on-premises primary and cloud standby | Unencrypted | Encrypted | Unencrypted | Encrypted | Unencrypted | Encrypted | In these cases the standby database is manually encrypted after instantiation |
| New tablespace creation on-premises primary | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Requires manual TDE conversion for standby database |
| Redo generated in on-premises primary | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | |
| Archived logs | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | Unencrypted | |
| New and changed blocks | Unencrypted | Encrypted | Unencrypted | Encrypted | Unencrypted | Encrypted | Redo shipped from the on-premises primary to the cloud is not encrypted |
| Recovery in the cloud standby | N/A | Encrypted | N/A | Encrypted | N/A | Encrypted | Redo shipped from the on-premises primary to the cloud is not encrypted |
Table B-2 Cloud Encrypted Primary and On-Premises Unencrypted Standby
| Operation | Cloud Primary 11g R2 | On-Premises Standby 11g R2 | Cloud Primary 12c R1 | On-Premises Standby 12c R1 | Cloud Primary 12c R2 | On-Premises Standby 12c R2 and later | Notes |
|---|---|---|---|---|---|---|---|
| New tablespace creation in cloud primary | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | ASO required for on-premises to decrypt |
| Redo generated in cloud primary | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | ASO required for on-premises to decrypt |
| Archived logs | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | Encrypted | ASO required for on-premises to decrypt |
| New and changed blocks for existing unencrypted tablespace on standby | Encrypted | Encrypted* | Encrypted | Encrypted* | Encrypted | Unencrypted | ASO is required on-premises to decrypt and encrypt
* For 11g R2 and 12c R1 redo apply will encrypt only if redo is encrypted |
| Recovery in the on-premises standby | N/A | Encrypted | N/A | Encrypted | N/A | Unencrypted data depends on whether the datafile is encrypted | ASO required for on-premises database |