Oracle Cloud Infrastructure Documentation

Exascale Database - AKV

Oracle Exadata Database Service on Exascale Infrastructure supports integration with Azure Key Vault (AKV). This capability allows you to manage transparent data encryption (TDE) master encryption keys (MEKs) using Azure customer-managed keys.

To configure Azure Key Vault to encrypt your database, complete the following steps:

  1. Create an Azure Key Vault from the Azure Portal
  2. Create a Key on Azure Key Vault from the Azure Portal
  3. Create an Exascale VM Cluster from the Azure Portal
  4. Disable Azure Key Vault Public Access from the Azure Portal
  5. Obtain Azure Key Vault DNS Zones Information from the Azure Portal
  6. Add Private AKV DNS Zones from the OCI Console
  7. Create the Network Requirements for Creating an Identity Connector from the Azure Portal
  8. Create an Identity Connector for Exascale VM Cluster from the OCI Console
  9. Create an IAM Policy for Accessing Azure AKV Key Resources from the OCI Console
  10. Enable the Azure Key Management from the OCI Console
  11. Configure Microsoft Entra ID Permissions for Key Vault Access from the Azure Portal
  12. Register Azure Key Vault in the OCI Console
  13. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution from the OCI Console
  14. Modify the Key Management from Oracle Wallet to Azure Customer-Managed Key (CMK) from the OCI Console
    1. Create an Azure Key Vault

      For step-by-step instructions, see Prerequisites.

    2. Create a Key on Azure Key Vault

      For step-by-step instructions, see Prerequisites.

    3. Create an Exascale VM Cluster

      For step-by-step instructions, see Exascale VM Cluster.

    4. Disable Azure Key Vault Public Access
      1. From the Azure portal, select Key vaults.
      2. Select the Name field of the Key vault that you want to use.
      3. Expand the Settings section, and then select Networking.
      4. From the Firewalls and virtual networks tab, you can optionally disable public access.
        Note

        After the public access is disabled, Azure Key Vault is accessible only through a Private Endpoint.
      5. Select the Apply button to save the changes.
      This screenshot shows how to disable AKV public access.
    5. Obtain Azure Key Vault DNS Zones Information
      Note

      During Azure Key Vault creation, when the private endpoint (privatelink.vaultcore.azure.net) is set up, a private DNS zone is created by the workflow. Two Private DNS Zones need to be added in OCI to allow the Exascale Database to resolve private endpoint URLs to the correct private IP addresses.
      1. From the Azure portal, select Key vaults.
      2. Select the Name field of the Key vault that you want to use.
      3. Expand the Settings section, and then select Networking.
      4. From the Private endpoint connections tab, select the Private endpoint name.
      5. From the left menu, expand the Settings section, and then select DNS configuration. Note the FQDN and IP addresses information.This screenshot shows how to obtain FQDN and IP address information.
      6. Navigate to the Azure portal, and then select Private DNS zones.
      7. From the list, select the privatelink.vaultcore.azure.net DNS zone. Expand the DNS Management section, and then select Recordsets.
      8. Take a note of the A record created for Azure Key Vault.
      This screenshot shows how to obtain A record information.
    6. Add Private AKV DNS Zones

      Complete the step-by-step instructions from the OCI Console.

    7. Create the Network Requirements for Creating an Identity Connector
      Azure Key Management Service (KMS) resources support both public and private connectivity. Azure Key Vault Managed HSM requires private connectivity, whereas Azure Key Vault Premium and Standard tiers support both public and private connectivity options.
      • Configuration Using Private Network

      To create an Identity Connector over a private network, you must configure an Azure Arc Private Link Scope and a Private Endpoint through the Azure Portal.

      1. Create Azure Arc Private Link Scopes
        1. From the Azure portal, navigate to Azure Arc.
        2. Expand the Additional setup section, and then select Private link scopes.
        3. Select the + Create button to start the creation process.
        4. From the Basics tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
          1. Select the Subscription that you want to use, and then select the Resource group.
          2. Enter a descriptive Name for the private link scope. The private link scope name can contain only alphanumeric characters and the following symbols: hyphen (-), period (.) , and underscore (_). The name can not begin with underscore (_) or end with period (.) or hyphen (-).
          3. Select the Region.
          4. Select the Next: Private endpoint > button to proceed.
          This screenshot shows how to create Azure Arc Private Link Scopes.
        5. From the Private endpoint tab of the Create an Azure Arc Private Link Scope flow, enter the following information.
          1. Select the + Create button to create a private endpoint.
          2. The Subscription field populates automatically.
          3. Select the Resource group.
          4. For the Location field, select the region corresponding to your Exascale VM Cluster deployment.
          5. Enter a descriptive Name for your private endpoint. The name must begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
          6. From the Networking section, select your Virtual network and Subnet.
          7. Choose the Yes option to integrate with private DNS zone. This automatically creates a new private DNS zone.
          8. Select the OK button.
          9. Select the Next: Tags > button to proceed.
          This screenshot shows how to create Azure Arc Private Link Scopes.
        6. The Tags section is optional. To manage and create custom views of your resources, assign tags. Select the Next: Review + create > button.
        7. Once you review your information, select the Create button.This screenshot shows how to create Azure Arc Private Link Scopes.
      2. Obtain Azure Arc Private Link DNS Zones Information
        1. From the Azure portal, navigate to Private endpoints.
        2. Expand the Private link section, and then select Private endpoints.
        3. Select your private endpoint from the list and then expand the Settings section.
        4. Select the DNS configuration.
        5. Take a note of the FQDN and IP addresses information.This screenshot shows how to obtain Azure Arc Private Link DNS Zones information.
        Note

        The DNS configuration for the Private Endpoint associated with the Private Link Scope must include the necessary private agent resource addresses. For more information, see URLs.
      3. Create OCI Private Zone

        Complete the step-by-step instructions from the OCI Console.

      4. Create a NAT Gateway
        1. From the Azure Portal, select NAT Gateways.
        2. Choose the Subscription that you want to use, then select the Resource group.
        3. Enter a name for your NAT gateway, select the Region corresponding to your VNET, then select the Next button.
        4. In the Outbound IP tab, select the Add Public IP addresses or prefixes button.
          1. You can select an existing public IP address or prefix or both to associate with the NAT gateway and enable outbound connectivity.
            1. To create a new public IP for the NAT gateway, select the Create a public IP address button. Enter a Name, and then select the OK button.
            2. To create a new public IP prefix for the NAT gateway, select the Create a new public IP prefix button. Enter a Name, select a Prefix size, then select the OK button.
          2. Once you enter your information, select the Next button.
        5. In Networking tab, select your Virtual Network, then select the subnet that you want to associate the NAT gateway.
        6. Select the Review + Create button, and then select the Createbutton.
    8. Create an Identity Connector for Exascale VM Cluster

      Creating an Identity Connector installs the Azure Arc agent on the Exascale VM Cluster VMs, registering them as Azure Arc-enabled virtual machines.

      This enables secure communication with the Azure Key Management Service (KMS) using the Azure identity generated by the Arc agent. The Azure Arc agent can communicate with Azure services over either a public network or a private connectivity setup. For more information, see Azure Arc.

      Each Exascale VM Cluster must have an identity connector enabled to access Azure resources. The identity connector establishes either a public or private connection between the Exascale VM Cluster and Azure Key Management resources, depending on the roles assigned.

      1. Generate an Access Token for your Azure Account
        1. From the Azure Portal, select the Cloud shell button.
        2. In the Cloud Shell, run the following command. Replace <Azure_subscription_ID> with your actual Azure Subscription ID.
          az account get-access-token --subscription <Azure_subscription_ID>
        3. The command will return a JSON object similar to the example below. Take a note of the accessToken value as it is required for the next steps.
          {
  "accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "expiresOn": "2026-03-25 14:35:43.000000",
  "expires_on": 1774449343,
  "subscription": "641531f9-2e12-430b-be35-XXXXXXXXXXXX",
  "tenant": "6798aca3-9d44-4ba7-8a36-XXXXXXXXXXXX",
  "tokenType": "Bearer"
}
        Note

        To see more information about access token, see az account get-access-token.
      2. Create an Identity Connector

        Complete the step-by-step instructions from the OCI Console.

      3. Validate the Identity Connector Status

        Complete the step-by-step instructions from the OCI Console.

    9. Create an IAM Policy for Accessing Azure AKV Key Resources

      Complete the step-by-step instructions from the OCI Console.

    10. Enable the Azure Key Management

      Complete the step-by-step instructions from the OCI Console.

    11. Configure Microsoft Entra ID Permissions for Key Vault Access
      1. Create a Azure Group in Microsoft Entra ID
        1. In the Azure portal, select Microsoft Entra ID.
        2. From the left menu, select Groups, and then select the New Group button.
        3. From the New Group page, enter the following information.
          1. Group type: Security
          2. Group name: Enter a descriptive name in the field.
          3. Group description: Enter a description in the field.
          4. Membership type: Assigned
          5. Review your information and then select the Create button.
        4. From the Azure portal, select Microsoft Entra ID and then select Groups.ttttt
        5. Locate the group name that you previously created and then select it.
          1. In the Group Memberships section, select the View group members link.
          2. Select the + Add member button.
          3. Add the Azure Arc name of each node of your Exascale VM Cluster node, then choose the select button.
          ttttt
      2. Assign Permission to the Azure Key Vault
        1. From the Azure portal, select Key vaults and then select the Key vault that you want to use.
        2. From the left menu, select Access control (IAM).
        3. Select the + Add button, then select the Add role assignment option.
        4. From the Role tab, search for the Reader role, then select the Next button.tttt
        5. In the Members tab, select the User, group, or service principal option, then choose the Select members link.
        6. Search for the Group Name that you previously created. It contains the Azure Arc Names of your Exascale VM Cluster nodes, then choose the Select button.tttt
        7. Review your information and then select the Review + assign button.tttt
        8. Repeat the step to assign the Key Vault Crypto Officer role.
          Note

          The Reader and Key Vault Crypto Officer roles must be assigned to the group to grant the necessary permissions to access and manage Azure Key Vault Premium and Azure Key Vault Standard resources.
      3. Validate the Key Vault Permissions
        1. From the Azure portal, select Key vaults and then select the Key vault that you want to use.
        2. From the left menu, select Access control (IAM).
        3. From the Check access section, select the Check access button.
        4. Search for your Azure Arc Group name that you previously created, then select the Group Name.
        ttttt
    12. Register Azure Key Vault

      Complete the step-by-step instructions from the OCI Console.

    13. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution

      Complete the step-by-step instructions from the OCI Console.

    14. Modify the Key Management from Oracle Wallet to Azure Customer-Managed Key (CMK)

      Complete the step-by-step instructions from the OCI Console.

    1. Add Private AKV DNS Zones
      1. From the OCI Console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
      2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.
      3. From the OCI Console, navigate to Networking section, and then select Virtual cloud networks.
      4. From the Details tab, select DNS Resolver link.
      5. From the Private resolvers page, select the Default private view link.
      6. In the Private view page, select the Private zones tab.

        If the DNS Zone already exists in your environment, add the record to your existing Private Zone.

      7. In the Private Zones section, select the Create zone button to create the first private zone.
        1. The Zone type field is set to Primary by default.
        2. Enter a descriptive Zone name. Select the zone name that matches the domain FQDN copied in the previous step. For example, vault.azure.net.
        3. From the dropdown list, select the Compartment in which you want to create the private zone.
        4. The Tags section is optional.
        5. Select the Create button.
        6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
        7. Select the Manage records button.
        8. From the Manage records page, select the Add record button.
          1. For the Name field, enter the FQDN name that you previously noted.
          2. Select the A- IPv4 address option as your Type.
          3. Adjust the TTL in seconds based on your requirements.
          4. Select your RDATA mode.
          5. In the Address field, enter the IP address that you previously noted , then select the Save changes button.
        9. Select the Review changes button, then select the Publish Changes button.
        10. To create a second zone, select the Create zone button.
          1. The Zone type field is set to Primary by default.
          2. In the Zone name field, enter a zone name based on your Private DNS Zone domain. For example, privatelink.vaultcore.azure.net.
          3. From the dropdown list, select the Compartment in which you want to create a private zone.
          4. The Tags section is optional.
          5. Select the Create button.
          6. Select the Zone name field of the zone that you previously created, and then select the Records tab.
          7. Select the Manage records button.
          8. From the Manage records page, select the Add record button.
            1. For the Name field, enter your Azure Private zone record set name.
            2. Select the A- IPv4 address option as your Type.
            3. Adjust the TTL in seconds based on your requirements.
            4. Select your RDATA mode.
            5. In the Address field, enter the IP address that you previously noted, then select the Save changes button.
          9. Select the Review changes button, then select the Publish Changes button.
    2. Create the Network Requirements for Creating an Identity Connector
      1. Create OCI Private Zone
        1. From the OCI console, select Oracle AI Database and then select Oracle Exadata Database Service on Exascale Infrastructure. Select the name of your Exascale VM Cluster.
        2. Scroll down to the Network section, then select the Virtual Cloud Network.
        3. In the VCN information section, under DNS Resolver, select DNS Resolver Name.
        4. From the Private Resolver section, select the Default Private view name.
        5. In the Private view page, select Private zones tab.
        6. From the Private zones page, select the Create zone button to create the first private zone.
          1. In the Zone name, select the name according with your domain FQDN which you copied in the previous step. For example, arc.azure.com.
          2. Select the Create button.
          3. Select the name field of the zone that you created in the previous step.
          4. Select the Records tab, and then select Manage records button.
          5. Select the Add record button.
            1. For the name field, paste your FQDN name. For example, gbl.
            2. Select A- IPv4 address as your type.
            3. In the Address field, enter the IP addresses that you copied in the previous step. Then, select the Save changes button.
          6. Select the Review changes button, then select Publish Changes button.
          7. Repeat the previous step until you have added all records to the specified Private Zone.
        7. Create all the Private zones, and add the records obtained from the Obtain Azure Arc Private Link DNS Zones Information step.
          Note

          Even with Private Connectivity, the following endpoints must be routed through the Azure NAT gateway.
          Agent resources:
          • guestconfiguration.azure.com
          • his.arc.azure.com
          • login.microsoftonline.com
          • management.azure.com
          • pas.windows.net
          • guestconfiguration.azure.com
          • packages.microsoft.com
          • aka.ms

          You must ensure the connectivity to these endpoints. Otherwise, the Identity Connector creation will fail.

    3. Create an Identity Connector

      Creating an Identity Connector installs the Azure Arc agent on the Exascale VM Cluster VMs, registering them as Azure Arc-enabled virtual machines.

      This enables secure communication with the Azure Key Management Service (KMS) using the Azure identity generated by the Arc agent. The Azure Arc agent can communicate with Azure services over either a public network or a private connectivity setup. For more information, see Azure Arc.

      Each Exascale VM Cluster must have an identity connector enabled to access Azure resources. The identity connector establishes either a public or private connection between the Exascale VM Cluster and Azure Key Management resources, depending on the roles assigned.

      1. Create an Identity Connector
        1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
        2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.
        3. From the VM Cluster information tab, scroll down to the Identity connector section, and then select the Create button.
        4. From the Create identity connector page, enter the following information.
          1. Enter the Azure Tenant id.
          2. Paste the Access token that you copied in the previous step.
          3. Expand the Advanced Options menu, then enter the name of your Azure Arc Private Link Scope that you previously created.
          4. The Tags section is optional.
          5. Review your information and then select the Create button.
      2. Validate the Identity Connector Status
        1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
        2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.
        3. In the VM Cluster information tab, locate the Multicloud information section.
        4. Under Identity connector, select the Identity connector link. This will redirect you to the Identity Connector Information page, where you can verify the status. Ensure that the status is shown as Active.
    4. Create an IAM Policy for Accessing Azure AKV Key Resources

      The database uses the cluster resource principal to securely retrieve Azure Cloud key resources. To enable this functionality, you must define the appropriate IAM policies in your OCI tenancy.

      To create the appropriate IAM policies, complete the following steps.

      1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
      2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.
      3. In the VM Cluster information tab, scroll down to the General information section and take a note of the Compartment information.
      4. Navigate back to OCI Console, select Identity & Security and then select Compartments.
      5. Locate the Compartment that you previously recorded. From the Details tab, take a note of the compartment OCID information.
      6. Navigate back to OCI Console, select Identity & Security and then select Policies. Select the Create Policy button.
        1. Enter a policy Name.
        2. Select the root compartment.
        3. Select the show manual editor button, paste the following policy, and replace the <your-compartment-OCID> with the compartment OCID that you previously copied.
          
Allow any-user to read oracle-db-azure-vaults in compartment id  <your-compartment-OCID> where all { request.principal.type = 'exadbvmcluster'}
      7. Select the Create button.
    5. Enable the Azure Key Management
      1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
      2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.This screenshot show how to enable the Azure key management.
      3. In the VM Cluster information tab, scroll down to the Azure key management section, and select the Enable button. The confirmation message appears, select the Enable button to confirm it.This screenshot show how to enable the Azure Key Management.
      Note

      • When you provision an Exascale VM Cluster, Azure key management is disabled by default.
      • If you do not want to use Azure key management, you can disable it by selecting the Disable button. This action will disable Azure key management at the VM Cluster level. Disabling it will impact the availability of the databases using Azure key management. Ensure that no database is currently using Azure key management.
      • Azure key management is configured at the VM cluster level, requiring all databases in the cluster to use the same key management solution. However, databases that use Oracle Wallet can coexist alongside those that use Azure Key Vault within the same VM cluster.
    6. Register Azure Key Vault

      To enable Azure key management for your Exascale VM Cluster, you must first register your Azure Key Vault in the OCI Console.

      1. From the OCI Console, select Oracle AI Database, and then select Database Multicloud Integrations.
      2. From the left menu, select Microsoft Azure Integration, then select Azure Key Vaults.
      3. Select the Register Azure key vaults button, and then complete the following substeps.
        1. From the dropdown list, select the Compartment in which your Exascale VM Cluster resides.
        2. Select your identity connector from the dropdown list.
        3. The Key Vault Name field is optional.
        4. Select the Discover button.
      4. Once the key is discovered, select the Key vault checkbox, then select the Register button to register the key in OCI.
        Note

        Ensure the Azure Key Vault contains at least one valid key. Otherwise, the discovery process will not return any information.
    7. Create a Database and Use Azure Customer-Managed Key (CMK) as the Key Management Solution
      1. Complete the following steps described in the Create - Exascale Database documentation to create an Exascale Database.
      2. Navigate to the Encryption section which provides two options. These options include Oracle Wallet and Azure Key Vault.
      3. Select the Azure Key Vault as the key management. Select the Compartment and the Azure Key Vault from the dropdown list, then select the Key from the dropdown list.
      4. Review your information, and then select the Create button.
      This screenshot shows how to create a container database and use Azure customer-managed key (CMK) as the key management solution.
    8. Modify the Key Management from Oracle Wallet to Azure Customer-Managed Key (CMK)

      To update key management from Oracle Wallet to Azure Customer-Managed Key, complete the following steps:

      1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
      2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster.
      3. Select Container databases tab, and then select the database that you are using.
      4. From the Encryption section, confirm that Key management is set to Oracle Wallet, and then select the Change button.
      5. From the Change key management page, enter the following information.
        1. Select your Key management as Azure Key Vault from the dropdown list.
        2. Select the key compartment you are using, and select the desired Azure Key Vault from the dropdown list, then select the key from the dropdown list.
        3. Select the Save changes button.
      This screenshot shows how to change the key management.

    Azure Customer-Managed Key allows you to rotate the key at both Container Database (CDB) and Pluggable Database (PDB) levels to meet your security compliance requirements. Complete the following steps to rotate the key:

    Rotate the Azure Customer-Managed Key of a Container Database (CDB)
    1. From the OCI console, select Oracle AI Database, then select Oracle Exadata Database Service on Exascale Infrastructure.
    2. From the left menu, select VM Clusters, and then select your Exascale VM Cluster that you want to rotate encryption keys.
    3. Select Container databases tab, and then select the database that that you want to rotate encryption keys.
    4. From the Encryption section, verify that the Key Management is set to Azure Key Vault, and then select the Rotate button.This screenshot shows how to rotate a key.
    5. Select the Confirm button to save the changes.This screenshot shows how to rotate a key.
    Rotate the Azure Customer-Managed Key of a Pluggable Database (PDB)
    1. From the OCI console, select Oracle AI Database, and then select Oracle Exadata Database Service on Exascale Infrastructure.
    2. Select your Exascale VM Cluster, and then select Container databases tab.
    3. Select the Name field of your Container Database that you are using, and then select Pluggable Databases tab.
    4. Select the Name field of the Pluggable Database that you want to rotate encryption keys.
    5. The Encryption section displays that the Key Management is set as Azure Key Vault. This screenshot shows how to rotate a key.
    6. Select the Rotate button, and then select the Confirm button to save the changes.This screenshot shows how to rotate a key.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.

  • There is currently no content for this page. Oracle AI Database@Azure team intends to add content here, and this placeholder text is provided until that text is added. The Oracle AI Database@Azure team is excited about future new features, enhancements, and fixes to this product and this accompanying documentation. We strongly recommend you watch this page for those updates.