Provision Private Connectivity from Oracle Integration to Oracle AI Database@AWS

Oracle Integration can connect privately to an Oracle AI Database@AWS deployment by using an Oracle Integration private endpoint combined with Oracle Cloud Infrastructure virtual cloud network (VCN) peering.

No traffic traverses the public internet, a customer VPN, or a customer-managed multicloud connectivity. The entire path stays within the privately managed networks of Oracle and AWS.

Although the database physically runs on Oracle-operated Exadata infrastructure in an Amazon Web Services data center, an OCI child site, it surfaces in your OCI tenancy as a native OCI resource. An Oracle-managed VCN is anchored to the paired OCI region, the parent site. Connecting Oracle Integration to the database is a standard intra-OCI networking pattern.

When you provision Oracle AI Database@AWS, Oracle creates and manages a dedicated ODB network anchored to the paired OCI region. The Exadata VM cluster client and backup subnets are in the OCI VCN, and the database SCAN listeners expose private IP addresses in it. On the AWS side, the OCI VCN is represented as the ODB network. ODB network uses ODB peering and connects to the Amazon VPC and enables AWS workloads to reach the database privately.

Oracle Integration is an Oracle-managed PaaS service that reaches targets over public endpoints by default. An Oracle Integration private endpoint is assigned a private IP in the PE subnet of a VCN that you own. You then configure OCI routing, security rules, and DNS as you would for any private database in OCI.

Architecture

This reference architecture provides same-region and cross-region private connectivity patterns.

Same-region connectivity: Provision Oracle Integration in the same OCI region that the Oracle AI Database@AWS deployment anchors to. Pair the customer VCN local peering gateway (LPG) with the LPG on the OCI VCN within the ODB network.


Description of same-region-connectivity-oi-od-aws.png follows
Description of the illustration same-region-connectivity-oi-od-aws.png

same-region-connectivity-oi-od-aws-oracle.zip#GUID-D564F25E-D790-41C0-B5B1-0FB9E26415A6

  • An integration invokes an Oracle AI Database adapter connection that uses the Oracle Integration private endpoint.
  • Traffic egresses through the private endpoint, which is assigned a private IP in the customer VCN PE subnet.
  • The customer VCN LPG is peered with the LPG on the OCI VCN. The path remains private within OCI.
  • The connection reaches the SCAN listener on port 1521, or port 1522 for TLS/TCPS, in the client subnet.
  • The SCAN listener directs the session to an Oracle Real Application Clusters (Oracle RAC) node on the Exadata VM cluster, providing instance and node-level failover with zero-downtime maintenance.

The same-region diagram includes:

  • An Application VPC with App VMs or EC2, connected through ODB Peering to the ODB network that contains Oracle AI Database@AWS.
  • An ODB network with client and backup subnets. The client subnet contains the Oracle Exadata VM Cluster and its SCAN listener for TCP port 1521 or TCPS port 1522.
  • A Customer VCN with a Private Endpoint in a PE subnet. The Private Endpoint connects to Oracle Integration in the Oracle Services Network.
  • A two-way local peering connection between the ODB network LPG and Customer VCN LPG.
  • Amazon S3 and Oracle Database Autonomous Recovery Service as backup and recovery services.

Cross-region connectivity: If the Oracle Integration instance runs in a different OCI region than the Oracle AI Database@AWS deployment, LPGs cannot provide the connection because LPG peering is limited to one OCI region. Use a customer-managed dynamic routing gateway (DRG) in each region, a remote peering connection between the DRGs, and a hub VCN in the database home region.


Description of cross-region-connectivity-oi-od-aws.png follows
Description of the illustration cross-region-connectivity-oi-od-aws.png

cross-region-connectivity-oi-od-aws-oracle.zip#GUID-6ED49975-9B0C-495A-A723-051B0CE9FC26

  • Oracle Integration egresses through its private endpoint in the customer VCN in the Oracle Integration region.
  • The customer VCN is attached to DRG-A. A route rule sends the ODB network CIDR to the DRG.
  • DRG-A connects to DRG-B through a remote peering connection. Traffic between regions remains private.
  • DRG-B routes into the hub VCN. Its LPG is peered with the ODB network LPG.
  • Traffic reaches the SCAN listener and the Oracle RAC cluster as in the same-region flow.

The cross-region diagram includes:

  • An Application VPC connected through ODB Peering to Oracle AI Database@AWS and its ODB network with client and backup subnets.
  • A two-way local peering connection from the ODB network LPG to an LPG in the Database Region Hub VCN in OCI Region B.
  • A two-way connection from the Database Region Hub VCN DRG to the Customer VCN DRG in OCI Region A through remote peering.
  • A Customer VCN with a Private Endpoint in a PE subnet. The Private Endpoint connects to Oracle Integration in the Oracle Services Network.
  • Amazon S3 and Oracle Database Autonomous Recovery Service as backup and recovery services.

These architectures have the following components:

  • Dynamic routing gateway (DRG)

    The DRG is a virtual router that provides a path for private network traffic between VCNs in the same region, between a VCN and a network outside the region, such as a VCN in another OCI region, an on-premises network, or a network in another cloud provider.

  • Local peering

    Local peering allows two VCNs within the same OCI region to communicate directly using private IP addresses. This communication does not traverse the internet or your on-premises network. Local peering is enabled by a Local Peering Gateway (LPG), which serves as the connection point between VCNs. Configure an LPG in each VCN and establish a peering relationship to allow instances, load balancers, and other resources in one VCN to securely access resources in another VCN within the same region.

  • Network security group (NSG)

    NSGs act as virtual firewalls for your cloud resources. With the zero-trust security model of OCI you control the network traffic inside a VCN. An NSG consists of a set of ingress and egress security rules that apply to only a specified set of virtual network interface cards (VNICs) in a single VCN.

  • Oracle Services Network

    The Oracle Services Network (OSN) is a conceptual network on OCI that is reserved for Oracle services. These services have public IP addresses that you can reach over the internet. Hosts outside Oracle Cloud can access the OSN privately by using Oracle Cloud Infrastructure FastConnect or VPN Connect. Hosts in your VCNs can access the OSN privately through a service gateway.

  • OCI region

    An OCI region is a localized geographic area that contains one or more data centers, hosting availability domains. Regions are independent of other regions, and vast distances can separate them (across countries or even continents).

  • Remote peering

    Remote peering enables private communication between resources in different VCNs, which can be located in the same or different OCI regions. Each VCN uses its own Dynamic Routing Gateway (DRG) for remote peering. The DRGs securely route traffic between the VCNs over OCI's private backbone, allowing resources to communicate using private IP addresses without routing traffic over the internet or through on-premises networks. Remote peering removes the need for internet gateways or public IP addresses for instances that need to connect across regions.

  • Security list

    For each subnet, you can create security rules that specify the source, destination, and type of traffic that is allowed in and out of the subnet.

  • Oracle Exadata Database Service

    enables you to leverage the power of Exadata in the cloud. Oracle Exadata Database Service delivers proven Oracle AI Database capabilities on purpose-built, optimized Oracle Exadata infrastructure in the public cloud. Built-in cloud automation, elastic resource scaling, security, and fast performance for all Oracle AI Database workloads helps you simplify management and reduce costs.

  • Oracle Integration

    Oracle Integration is a fully-managed, preconfigured environment that allows you to integrate cloud and on-premises applications, automate business processes, and develop visual applications. It uses an SFTP-compliant file server to store and retrieve files and allows you to exchange documents with business-to-business trading partners by using a portfolio of hundreds of adapters and recipes to connect with Oracle and third-party applications.

  • OCI virtual cloud network and subnet

    A virtual cloud network (VCN) is a customizable, software-defined network that you set up in an OCI region. Like traditional data center networks, VCNs give you control over your network environment. A VCN can have multiple non-overlapping classless inter-domain routing (CIDR) blocks that you can change after you create the VCN. You can segment a VCN into subnets, which can be scoped to a region or to an availability domain. Each subnet consists of a contiguous range of addresses that don't overlap with the other subnets in the VCN. You can change the size of a subnet after creation. A subnet can be public or private.

  • Oracle AI Database@AWS

    Oracle AI Database@AWS is an Oracle AI Database cloud service on Oracle Cloud Infrastructure (OCI) that runs Oracle AI Database workloads in your Amazon Web Services (AWS) environment.

    Oracle AI Database@AWS brings OCI technologies, such as Oracle Exadata Database Service, Oracle Autonomous AI Database, Oracle Real Application Clusters (Oracle RAC) and Oracle Data Guard to AWS customers.

  • Oracle Database Autonomous Recovery Service

    Oracle Database Autonomous Recovery Service is a fully managed service designed to protect Oracle AI Databases from data loss and cyber threats. It offers faster backups with reduced database overhead, reliable recovery with validated backups, and real-time protection enabling recovery to within less than a second of an outage or ransomware attack. This service provides a centralized data protection dashboard and is recommended for backing up Oracle AI Databases with high resiliency.

  • Amazon virtual private cloud and subnet

    Amazon virtual private cloud (VPC) enables you to launch AWS resources into a virtual network you've defined. This virtual network resembles a traditional network that you operate in your own data center, with the benefits of using the scalable infrastructure of AWS. After you create an VPC, you can add subnets.

    A subnet is a range of IP addresses in your Amazon VPC. You can create AWS resources, such as Amazon EC2 instances, in specific subnets.

  • Amazon Simple Storage Service

    Amazon Simple Storage Service (Amazon S3) is a cloud-based object storage service that provides a scalable, secure, and durable platform for storing data. Amazon S3 can be used for managed backups.

  • ODB network

    An ODB network is a private network that hosts Oracle AI Database@AWS in a specified availability zone. You can set up an ODB peering connection between an ODB network and a VPC to connect to your Oracle databases.

Recommendations

Use these networking and security recommendations when you connect Oracle Integration privately to Oracle AI Database@AWS.
  • Customer-managed VCN and private-endpoint subnet: Provision a VCN and a PE subnet that you manage for the Oracle Integration private endpoint. A small subnet, such as a /28, reserved for endpoints is enough. Use regional subnets and place resources with the same role in the same subnet so that the subnet can serve as a security boundary.
  • Route tables and security rules: Configure the customer VCN route table to send the ODB network CIDR to the LPG in addition to the local route. Configure a return route to the PE subnet CIDR on the ODB network client subnet route table. Prefer network security groups scoped to the Oracle Integration private endpoint and database over broad security lists, and avoid 0.0.0.0/0 on the data path.
  • Prefer TCPS: Use TLS to the SCAN listener on port 1522. This provides in-transit encryption even on a private path.
  • DNS resolution: The private endpoint uses the customer VCN DNS resolver. Configure that resolver to resolve the database SCAN FQDN to its private IP addresses through a private DNS view or zone, or conditional forwarding to the ODB network resolver. DNS misconfiguration is the most common cause of a failed private endpoint connection. Validate DNS resolution before you go live.
  • Nonoverlapping CIDRs: Don't overlap the CIDR ranges of the customer VCN, hub VCN, and ODB network subnets. Overlapping ranges can't be peered and can't be fixed after provisioning without re-addressing. Size the ODB network's client and backup subnet CIDRs according to Oracle AI Database@AWS requirements, and govern CIDR allocation centrally.
  • High availability: Place Oracle Integration in the database OCI anchor region when possible so that you can use same-region LPG peering. Otherwise, plan DRG remote peering. Distribute application resources across availability domains and fault domains as appropriate for the region.
  • Restrict Oracle Integration access: A private endpoint secures outbound traffic only. Configure an allowlist so that only the specified IP addresses, CIDR blocks, and VCNs can reach the Oracle Integration instance.

Considerations

Consider these service, security, scale, and operational characteristics when you deploy private connectivity.
  • Private endpoint lifecycle: An Oracle Integration private endpoint is one per instance and cannot be modified after creation. To change its VCN or subnet, delete and recreate it.
  • Adapter support: Use a private-endpoint-supported adapter, such as the Oracle AI Database or Oracle ATP adapter, and confirm support for the target before designing around it.
  • Security: Configure the Oracle Integration connection with the database wallet or certificate. Exadata databases use Transparent Data Encryption. Oracle manages master keys by default, and you can hold them as customer-managed keys in OCI Vault. Consider OCI Vault for database passwords and other connection secrets, and use least-privilege OCI Identity and Access Management policies and database users. If the database is Zero Trust Packet Routing-secured, the Oracle Integration instance must have the required Zero Trust Packet Routing security attributes and use a private endpoint.
  • LPG limits and scale: A VCN supports a limited number of LPGs. If Oracle Integration must reach many databases across multiple ODB networks, use a hub VCN. The single-target pattern shown here is unaffected.
  • Monitoring and alerts: Monitor connectivity and throughput. Oracle AI Database@AWS also integrates with Amazon CloudWatch and AWS CloudTrail for database-level observability.
  • Scalability and cost: Size Oracle Integration message packs for the expected load and resize them as demand changes. Select OCI Compute shapes for supporting resources that provide optimal performance at the lowest cost.
  • Alternative configuration: Creating the private endpoint directly on an ODB network subnet removes the need for peering. Verify that this is permitted in the tenancy because the ODB network and its subnets are Oracle-managed.
  • Backups: Supported automatic backup destinations include Amazon S3 and Oracle Database Autonomous Recovery Service. Backup traffic uses the ODB network backup subnet and does not use the customer VCN.

Deploy

Configure private networking and an Oracle Integration private endpoint to connect to Oracle AI Database@AWS.

To deploy private connectivity from Oracle Integration to Oracle AI Database@AWS, complete these steps:

  1. Sign in to the OCI Console with your Oracle Cloud credentials.
  2. Confirm that the Oracle AI Database@AWS database, provisioned through the AWS Management Console or AWS Marketplace, and its auto-created ODB network with client and backup subnets are visible in the OCI tenancy.
  3. Provision the customer-managed VCN and private-endpoint subnet with the required network security group, route table, and DNS resolver configuration.
  4. Establish the required peering.

    Same-region connectivity: Pair the customer VCN LPG with the ODB network peer LPG.

    Update the route tables in both the customer VCN and the ODB network. Add a route in the customer VCN route table that directs traffic destined for the ODB network CIDR through the customer VCN LPG. Add a return route in the ODB network route table that directs traffic destined for the customer VCN CIDR, including the Oracle Integration private-endpoint subnet, through the ODB network LPG. Verify that the route rules are active before you configure the Oracle Integration private endpoint.

    Cross-region connectivity: Connect the DRGs with a remote peering connection and bridge to the ODB network through the hub VCN. Verify that the peering status is PEERED.

    After you establish the remote peering connection, update the route tables across the networking path. Add route rules in the customer VCN, customer VCN DRG, hub VCN, database-region DRG, and ODB network so that traffic destined for the ODB network CIDR is routed through the DRGs, remote peering connection, and LPG. Configure the corresponding return routes to direct traffic destined for the Oracle Integration private-endpoint subnet back through the LPG, DRGs, and remote peering connection to the customer VCN.

    Verify that all route rules are active before you configure the Oracle Integration private endpoint.

  5. Create the private endpoint for the Oracle Integration instance in the OCI Console.

    Select the customer VCN and PE subnet. OCI provisions the private endpoint with a private IP. The private endpoint cannot be edited after creation.

  6. Validate that the database SCAN FQDN resolves to its private IP addresses through the customer VCN resolver.
  7. Create an Oracle Integration connection that uses a private-endpoint-supported adapter.

    Provide the SCAN FQDN, service name, port 1522 for TLS, and the required credentials and wallet.

  8. Test the connection.

Outbound calls flow privately from Oracle Integration to the database SCAN listener and RAC nodes.

Explore More

Use these resources to learn more about private connectivity from Oracle Integration to Oracle AI Database@AWS.

Acknowledgments

  • Authors: Dilip Kumar Panchali, Achinthya Gopinath
  • Contributors: Sujit Nair, Antony Reynolds, Sreya Dutta