Oracle Cloud Infrastructure Documentation

Autonomous AI Database (Dedicated) - AKV

Oracle AI Database@Azure supports integration with Azure Key Vault (AKV) . This capability allows you to manage transparent data encryption (TDE) master encryption keys (MEKs) using Azure customer-managed keys.

To configure Azure Key Vault to encrypt your database, complete the following steps.

  1. Create an Azure Key Vault from the Azure Portal
  2. Create a Key on Azure Key Vault from the Azure Portal
  3. Create an Autonomous Exadata VM Cluster from the OCI Console
  4. Disable Azure Key Vault Public Access from the Azure Portal
  5. Obtain Azure Key Vault DNS Zones Information from the Azure Portal
  6. Add Private AKV DNS Zones from the OCI Console
  7. Create the Network Requirements for Creating an Identity Connector from the Azure Portal
  8. Create an Identity Connector from the OCI Console
  9. Create an IAM Policy for Accessing Azure AKV Key Resources from the OCI Console
  10. Enable the Azure Key Management from the OCI Console
  11. Configure Microsoft Entra ID Permissions for Key Vault Access from the Azure Portal
  12. Register Azure Key Vault from the OCI Console
  13. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution from the OCI Console
  14. Create an Autonomous AI Database from the OCI Console
    1. Create an Azure Key Vault

      For step-by-step instructions, see the CMK - AKV tab in the Prerequisites section.

    2. Create a Key on Azure Key Vault

      For step-by-step instructions, see the CMK - AKV tab in the Prerequisites section.

    3. Create an Autonomous VM Cluster

      For step-by-step instructions, see Autonomous VM Cluster.

    4. Disable Azure Key Vault Public Access
      1. From the Azure portal, select Key vaults.
      2. Select the Name field of the Key vault that you want to use.
      3. Expand the Settings section, and then select Networking.
      4. From the Firewalls and virtual networks tab, choose the Disable public access option.This screenshot shows how to disable public access.
        Note

        After the public access is disabled, Azure Key Vault is accessible only through a Private Endpoint.
      5. Select the Apply button to save the changes.
    5. Obtain Azure Key Vault DNS Zones Information
      Note

      During Azure Key Vault creation, when the private endpoint (privatelink.vaultcore.azure.net) is set up, a private DNS zone is created by the workflow. Two Private DNS Zones need to be added in OCI to allow the Autonomous AI Database (Dedicated) to resolve private endpoint URLs to the correct private IP addresses.
      1. From the Azure portal, select Key vaults.
      2. Select the Name field of the Key vault that you want to use.
      3. Expand the Settings section, and then select Networking.
      4. From the Private endpoint connections tab, select the Private endpoint name.This screenshot shows how to obtain AKV DNS zones information.
      5. From the left menu, expand the Settings section, and then select DNS configuration. Note the FQDN and IP addresses information.This screenshot shows how to obtain AKV DNS zones information.
      6. Navigate to Azure portal, and then select Private DNS zones.
      7. From the list, select the privatelink.vaultcore.azure.net DNS zone. Expand the DNS Management section, and then select Recordsets.
      8. Note the A record created for Azure Key Vault.This screenshot shows how to obtain AKV DNS zones information.
    6. Add Private AKV DNS Zones

      Complete the step-by-step instructions from the OCI Console.

    7. Create the Network Requirements for Creating an Identity Connector
      Azure Key Management Service (KMS) resources support both public and private connectivity. Azure Key Vault Managed HSM requires private connectivity, whereas Azure Key Vault Premium and Standard tiers support both public and private connectivity options.
      • Configuration Using Private Network

      To create an Identity Connector over a private network, you must configure an Azure Arc Private Link Scope and a Private Endpoint through the Azure Portal.

      1. Create Azure Arc Private Link Scopes
        1. From the Azure portal, navigate to Azure Arc.
        2. Expand the Additional setup section, and then select Private link scopes.
        3. Select the + Create button to start the creation process.
        4. From the Basics tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
          1. Select the Subscription that you want to use, and then select the Resource group.
          2. Enter a descriptive Name for the private link scope. The private link scope name can contain only alphanumeric characters and the following symbols: hyphen (-), period (.) , and underscore (_). The name can not begin with underscore (_) or end with period (.) or hyphen (-).
          3. Select the Region.
          4. Select the Next: Private endpoint > button to proceed.
        5. From the Private endpoint tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
          1. Select the + Create button to create a private endpoint.
          2. The Subscription field populates automatically.
          3. Select the Resource group.
          4. For the Location field, select the region corresponding to your Autonomous VM Cluster deployment.
          5. Enter a descriptive Name for your private endpoint. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
          6. From the Networking section, select your Virtual network and Subnet.
          7. Choose the Yes option to integrate with private DNS zone. This automatically creates a new private DNS zone.This screenshot shows how to create an Azure ARC Private Link scope.
          8. Select the OK button.
          9. Select the Next: Tags > button to proceed.
        6. The Tags section is optional. To manage and create custom views of your resources, assign tags. Select the Next: Review + create > button.
        7. Once you review your information, select the Create button.
      2. Obtain Azure Arc Private Link DNS Zones Information
        1. From the Azure portal, navigate to Private endpoints.
        2. Expand the Private link section, and then select Private endpoints.
        3. Select your private endpoint from the list and then expand the Settings section.
        4. Select the DNS configuration.
        5. Take a note of the FQDN and IP addresses information.This screenshot shows how to obtain FQDN and IP address information.
        Note

        The DNS configuration for the Private Endpoint associated with the Private Link Scope must include the necessary private agent resource addresses. For more information, see URLs.
      3. Create OCI Private Zone

        Complete the step-by-step instructions from the OCI Console.

      4. Create a NAT Gateway
        1. From the Azure Portal, select NAT Gateways and then select the + Create button.
        2. From the Create network address translation (NAT) gateway page to start the creation flow.
        3. From the Basics tab of the Create network address translation (NAT) gateway flow, complete the following steps:
          1. Choose the Subscription which your Azure NAT gateway will be created.
          2. Select an existing Resource group or select the Create new link to create and use a new Resource group for this resource. A resource group is a collection of resources sharing the same lifecycle, permissions, and policies.
          3. Enter a descriptive name in the NAT gateway name field. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
          4. Select the Region based on your VNET.
          5. Choose the SKU based on your requirements.
          6. Select the Next button to proceed.
        4. From the Outbound IP tab of the Create network address translation (NAT) gateway flow, select the + Add Public IP addresses or prefixes button.
          1. You can select an existing public IP address or prefix or both to associate with the NAT gateway and enable the outbound connectivity.
            1. To create a new public IP for the NAT gateway, select the Create a public IP address link.
              1. Enter a descriptive name in the Name field. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
              2. Select the OK button to confirm the changes.
            2. To create a new public IP prefix for the NAT gateway, select the Create a new public IP prefix link.
              1. Enter a descriptive name in the Name field. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
              2. From the dropdown list, select a Prefix size, and then select the OK button to confirm the changes.
          2. Review your information, and then select the Next button to proceed.
        5. From the Networking tab of the Create network address translation (NAT) gateway flow, complete the following steps.
          1. From the dropdown list, select your Virtual network, then select the subnet that you want to associate the NAT gateway.
        6. The Tags tab of the Create network address translation (NAT) gateway flow is optional. Select Next to proceed.
        7. From the Review + create tab of the Create network address translation (NAT) gateway flow, you can check the values that you entered from the previous steps. If the validation fails, you must correct any errors before you can start the provisioning process. Select the Review + create button to create.
    8. Create an Identity Connector

      Creating an Identity Connector installs the Azure Arc agent on the Autonomous VM Cluster VMs, registering them as Azure Arc-enabled virtual machines.

      This enables secure communication with the Azure Key Management Service (KMS) using the Azure identity generated by the Arc agent. The Azure Arc agent can communicate with Azure services over either a public network or a private connectivity setup. For more information, see Azure Arc.

      Each Autonomous VM Cluster must have an identity connector enabled to access Azure resources. The identity connector establishes either a public or private connection between the Autonomous VM Cluster and Azure Key Management resources, depending on the roles assigned.

      1. Generate an Access Token for your Azure Account
        1. From the Azure Portal, select the Cloud shell button.
        2. In the Cloud Shell, run the following command. Replace <Azure_subscription_ID> with your actual Azure Subscription ID. 
          az account get-access-token --subscription <Azure_subscription_ID>
        3. The command will return a JSON object similar to the example below. Take a note of the accessToken value as it is required for the next steps. For more information about access token, see az account get-access-token.
          {
  "accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJXXXXXXXXXXXXXXXXX",
  "expiresOn": "2026-03-25 14:35:43.000000",
  "expires_on": 1774449343,
  "subscription": "641531f9-2e12-430b-be35-XXXXXXXXXXXX",
  "tenant": "6798aca3-9d44-4ba7-8a36-XXXXXXXXXXXX",
  "tokenType": "Bearer"
}
        This screenshot shows how to generate an access token for your Azure account.
      2. Create an Identity Connector

        Complete the step-by-step instructions from the OCI Console.

      3. Validate the Identity Connector Status

        Complete the step-by-step instructions from the OCI Console.

    9. Create an IAM Policy for Accessing Azure AKV Key Resources

      Complete the step-by-step instructions from the OCI Console.

    10. Enable the Azure Key Management

      Complete the step-by-step instructions from the OCI Console.

    11. Configure Microsoft Entra ID Permissions for Key Vault Access
      1. Enable Azure role-based access control (RBAC) on the Azure Key Vault
        1. From the Azure portal, select Key vaults, and then select the Key vault that you want to use.
        2. From the left menu, expand the Settings section, and then select Access configuration.
        3. In the Permission model section, choose the Azure role-based access control (recommended) option.
        4. Select the Apply button.
        This screenshot shows how to enable Azure role-based access control (RBAC) on the Azure Key Vault.
      2. Assign Permission to the Azure Key Vault
        1. From the Azure portal, select Key vaults, and then select the Key vault that you want to use.
        2. From the left menu, select Access control (IAM).
        3. Select the + Add button, then select the Add role assignment option.This screenshot shows how to add role assignment.
        4. From the Role tab, search for the Reader role, then select the Next button.This screenshot shows how to add role assignment.
        5. In the Members tab, choose the Managed identity option, then choose the Select members link.
          1. From the Select managed identities page, select your Subscription.
          2. Select Machine - Azure Arc option as your Managed identity.
          3. In the search field, enter the name of your Azure Arc Machine, and then select it from the list.
          4. To save the settings, choose the Select button.
          ttttt
        6. Review your information and then select the Review + assign button.
        7. Repeat the step to assign the Key Vault Crypto Officer role.
          Note

          The Reader and Key Vault Crypto Officer roles must be assigned to the identities to grant the necessary permissions to access and manage Azure Key Vault Premium and Azure Key Vault Standard resources.
      3. Validate the Key Vault Permissions
        1. From the Azure portal, select Key vaults and then select the Key vault that you want to use.
        2. From the left menu, select Access control (IAM).
        3. From the Check access section, select the Check access button.
        4. Select the Managed identity option.
        5. From the Managed identity dropdown list, select Machine - Azure Arc.
        6. In the Search field, enter your Azure Arc machine name, and then select it from the list.
        This screenshot shows how to validate the Azure Key Vault permissions.
    12. Register Azure Key Vault in the OCI Console

      Complete the step-by-step instructions from the OCI Console.

    13. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution

      Complete the step-by-step instructions from the OCI Console.

    14. Create an Autonomous AI Database

      Complete the step-by-step instructions from the OCI Console.

    1. Add Private AKV DNS Zones
      1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
      2. From the left menu, select Autonomous Exadata VM Clusters, and then select your Autonomous VM Cluster that you are using.
      3. From the Network section, select the Network link which redirects you to Virtual Cloud Networks page.
      4. From the Details tab, select DNS Resolver link.
      5. From the Private resolvers page, select the Default private view link..
      6. In the Private view page, select the Private zones tab.This screenshot shows how to create a zone.
        Note

        If the DNS Zone already exists in your environment, add the record to your existing Private Zone.
      7. In the Private Zones section, select the Create zone button to create the first private zone.
        1. The Zone type field is set to Primary by default.
        2. Enter a descriptive Zone name. Select the zone name that matches the domain FQDN copied in the previous step. For example, vault.azure.net.
        3. From the dropdown list, select the Compartment in which you want to create a private zone.
        4. The Tags section is optional.
        5. Select the Create button.
        6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
        7. Select the Manage records button.
        8. From the Manage records page, select the Add record button.
          1. For the Name field, enter the FQDN name that you previously noted.
          2. Select the A- IPv4 address option as your Type.
          3. Adjust the TTL in seconds based on your requirements.
          4. Select your RDATA mode.
          5. In the Address field, enter the IP address that you previously noted, then select the Save changes button.
        9. Select the Review changes button, then select the Publish Changes button.This screenshot shows how to create a record.
        10. To create a second zone, select the Create zone button.
          1. The Zone type field is set to Primary by default.
          2. In the Zone name field, enter a zone name based on your Private DNS Zone domain. For example, privatelink.vaultcore.azure.net.
          3. From the dropdown list, select the Compartment in which you want to create a private zone.
          4. The Tags section is optional.
          5. Select the Create button.
          6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
          7. Select the Manage records button.
          8. From the Manage records page, select the Add record button.
            1. For the Name field, enter your Azure Private zone record set name.
            2. Select the A- IPv4 address option as your Type.
            3. Adjust the TTL in seconds based on your requirements.
            4. Select your RDATA mode.
            5. In the Address field, enter the IP address that you previously noted, then select the Save changes button.
          9. Select the Review changes button, then select the Publish Changes button.
          This screenshot shows how to create a zone.
    2. Create the Network Requirements for Creating an Identity Connector
      1. Create OCI Private Zone
        1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
        2. From the left menu, select Autonomous Exadata VM Clusters, and then select your Autonomous VM Cluster that you are using.
        3. Scroll down to the Network section, then select the Network link which redirects you to Virtual Cloud Networks page.
        4. From the VCN Information section, select the DNS Resolver link.
        5. From the Details tab, scroll down to the Default preview view section, and then select the link.
        6. In the Private view page, select the Private zones tab.This screenshot shows how to create OCI Private Zone.
        7. From the Private zones page, select the Create zone button to create the first private zone.
          1. In the Zone name field, enter a descriptive name according to your domain FQDN which you copied in the previous step. For example, his.arc.azure.com.
          2. Select the compartment where you want to create the private zone.
          3. The Tags section is optional.
          4. Review your information, and then select the Create button.
          5. Select the name field of the zone that you created in the previous step.
          6. Select the Records tab, and then select Manage records button.
          7. Select the Add record button.
            1. For the name field, paste your FQDN name. For example, gbl.
            2. Select A- IPv4 address as your type.
            3. In the Address field, enter the IP addresses that you copied in the previous step. Then, select the Save changes button.
          8. Select the Review changes button, then select Publish Changes button.
          9. Repeat the previous step until you have added all records to the specified Private Zone.This screenshot shows how to create OCI Private Zone.This screenshot shows how to create OCI Private Zone.
          10. Create all the Private zones, and add the records obtained from the Obtain Azure Arc Private Link DNS Zones Information step
        Note

        Even with Private Connectivity, the following endpoints must be routed through the Azure NAT gateway.

        Agent resources:

        • login.microsoftonline.com
        • management.azure.com
        • pas.windows.net
        • guestconfiguration.azure.com
        • packages.microsoft.com
        • aka.ms

        You must ensure the connectivity to these endpoints. Otherwise, the Identity Connector creation will fail.

    3. Create an Identity Connector
      1. From the OCI Console, select Oracle AI Database, then select Oracle Database Multicloud Integrations.
      2. From the left menu, select Microsoft Azure Integration, and then select the Create identity connector button.
      3. From the Create identity connector page, complete the following steps:
        1. From the dropdown list, select the Compartment in which you want to create the Identity connector.
        2. Select Autonomous Exadata VM cluster as Resource type.
        3. From the dropdown list, select the Compartment where the Autonomous VM Cluster was created
        4. From the dropdown list, select your Autonomous VM Cluster.
        5. Identity connector name: The system automatically populates this field after you select your Autonomous VM Cluster.
        6. Enter the Azure tenant id and Azure subscription id.
        7. Enter the Azure resource group name
        8. Paste the Access token that you copied in the previous step.
        9. Expand the Advanced options section, then enter the name of your Azure Arc Private Link Scope that you previously created.
        10. The Tags section is optional.
        11. Review your information, and then select the Create button.
        This screenshot shows how to create OCI Private Zone.
    4. Validate the Identity Connector Status
      1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
      2. From the left menu, select Autonomous Exadata VM Clusters, and then select your Autonomous VM Cluster that you are using.
      3. From the General information tab, scroll down to the Identity Connector section.
      4. Select the Identity Connector link. This will redirect you to the Identity connector tab where you can monitor the status. Ensure that the status is shown as Active.
      This screenshot shows how to validate the identity connector status.
    5. Create an IAM Policy for Accessing Azure AKV Key Resources

      The database uses the cluster resource principal to securely retrieve Azure Cloud key resources. To enable this functionality, you must define the appropriate IAM policies in your OCI tenancy.

      To create the appropriate IAM policies, complete the following steps.

      1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
      2. From the left menu, select Autonomous Exadata VM Clusters, and then select your Autonomous VM Cluster that you are using.
      3. In the General information tab, scroll down to the General information section, and then take a note of the Compartment information.This screenshot shows how to obtain Compartment information.
      4. Navigate back to OCI Console, select Identity & Security and then select Compartments.
      5. Locate the compartment that you previously recorded. From the Details tab, take a note of the compartment OCID information.This screenshot shows how to obtain OCID information.
      6. Navigate back to OCI Console, select Identity & Security and then select Policies. Select the Create Policy button.
        1. Enter a policy Name.
        2. Select the root compartment.
        3. Select the show manual editor button, paste the following policy.
          allow any-user to manage oracle-db-azure-vaults in compartment id <your-compartment-OCID>  where ALL { request.principal.type in ('cloudautonomousvmcluster') }
        4. Select the Create button.
    6. Enable the Azure Key Management
      1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
      2. From the left menu, select Autonomous Exadata VM Clusters, and then select your Autonomous VM Cluster that you are using.
      3. From the General information tab, scroll down to the Azure key management section, and select the Enable button. Once the confirmation message appears, select the Enable button to confirm it.
        Note

        • When you create an Autonomous VM Cluster, Azure key management is disabled by default.
        • If you do not want to use Azure key management, you can disable it by selecting the Disable button. This action will disable Azure key management at the VM cluster level. Disabling it will impact the availability of the databases using Azure key management. Ensure that no database is currently using Azure key management.
        • Azure key management is configured at the VM cluster level, requiring all databases in the cluster to use the same key management solution. However, databases that use Oracle Wallet can coexist alongside those that use Azure Key Vault within the same VM cluster.
      This screenshot shows how to enable AKV.
    7. Register Azure Key Vault

      To enable Azure key management for your Autonomous VM Cluster, you must first register your Azure Key Vault in the OCI Console.

      1. From the OCI Console, select Oracle AI Database, and then select Database Multicloud Integrations.
      2. From the left menu, select Microsoft Azure Integration, and then select Azure Key Vaults.
      3. Select the Register Azure key vaults button, and then complete the following steps:
        1. From the dropdown list, select the Compartment in which your Autonomous VM Cluster resides.
        2. Select your identity connector from the dropdown list.
        3. Enter a descriptive key vault name in the Key vault name field. This step is optional.
        4. Select the Discover button.
        This screenshot shows how to register AKV.
      4. Once the key is discovered, select the Key vault checkbox, then select the Register button to register the key in OCI.
        Note

        Ensure the Azure Key Vault contains at least one valid key. Otherwise, the discovery process will not return any information.
      This screenshot shows how to register AKV.
    8. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution
      1. Complete the following steps described in the Create - Autonomous AI Database (Dedicated) documentation to create an Autonomous AI Database on Dedicated Infrastructure.
      2. From the Create Autonomous Container Database page, navigate to the Advanced options section, and expand the section.
      3. Scroll down to the Encryption section, and then select Encrypt using a customer-managed key.
        1. Select Azure key management as a key type.
        2. Select the Compartment from the dropdown list.
        3. From the Vault dropdown list, select your Azure Key Vault, and then select the Key from the dropdown list.
        This screenshot shows how to create an Autonomous Container Database and use Azure Customer-Managed Key (CMK) as the Key Management Solution.
      4. Review your information, and then select the Create button.
    9. Validate Azure Key Vault as the Customer-managed Key Method
      1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
      2. From the left menu, select Autonomous Exadata VM Clusters, select the Autonomous Container Databases tab, then select the name of your Autonomous Container Database.
      3. From the Autonomous Container Database information tab, scroll down to the Encryption section to view the Key Management, Vault and Key information.
      4. Verify that Key Management is set to Azure key management with the vault and key used for encryption.
      This screenshot shows how to validate Azure Key Vault as the Customer-managed Key Method.
    10. Create an Autonomous AI Database
      Note

      Oracle AI Database inherits the encryption key method and configuration from the parent Autonomous Container Database.

      Complete the following steps described in the Create - Autonomous AI Database (Dedicated) documentation to create an Autonomous AI Database on Dedicated Exadata Infrastructure.

    Azure Customer-Managed Key allows you to rotate the key at Container Database (CDB) level to meet your security compliance requirements. Complete the following steps to rotate the key:

    Rotate the Azure Customer-Managed Key of a Container Database (CDB)

    1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
    2. From the left menu, selectAutonomous Container Databases, and then select the Autonomous Container Database that you want to rotate encryption keys.
    3. Select the Actions button, then select the Rotate encryption key option. This screenshot shows how to rotate the encryption key.
    4. Select the Rotate encryption key button to rotate the encryption key. This screenshot shows how to rotate the encryption key.

    Rotate the Azure Customer-Managed Key of a Pluggable Database (PDB)

    1. From the OCI Console, select Oracle AI Database, then select Autonomous AI Database on Dedicated Infrastructure.
    2. From the left menu, select Autonomous AI Databases, and then select the Autonomous AI Database that you want to rotate encryption keys.
    3. Select the More actions button, then select the Rotate encryption Key option.This screenshot shows how to rotate the encryption key.
    4. Select the Rotate encryption key button to rotate the encryption key. This screenshot shows how to rotate the encryption key.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.