Register Amazon RDS for Oracle with an Oracle Data Safe Private Endpoint
If you intend to connect through a Data Safe private endpoint, you must have an established network peering connection, such as FastConnect or VPNConnect, between your Oracle Cloud Infrastructure (OCI) tenancy and your Amazon cloud environment prior to registering your target database.
Preregistration Tasks for Registering Amazon RDS for Oracle with an Oracle Data Safe Private Endpoint
The below topics should be completed before registering a target database with Oracle Data Safe with connection through a Data Safe Private Endpoint. One private endpoint can be used to register multiple target databases, but there can only be one private endpoint per Virtual Cloud Network (VCN). If you are establishing a TCP connection, you do not need to perform the steps to create a wallet for TLS connection.
Task Number | Task | Link to Instructions |
---|---|---|
1 | In Oracle Cloud Infrastructure Identity and Access Management (IAM), obtain permissions to register a database with Oracle Data Safe | Permissions to Register a Target Database with Oracle Data Safe |
2 | In Oracle Cloud Infrastructure Identity and Access Management (IAM), obtain permissions to use an Oracle Data Safe Private Endpoint | Permissions for an Oracle Data Safe Private Endpoint |
3 | In Oracle Cloud Infrastructure Identity and Access Management (IAM), obtain permissions to use the underlying virtual networking resources of the private endpoint. | Virtual Cloud Networking Resources |
4 | Create an Oracle Data Safe service account on your target database and grant it Oracle Data Safe roles. Create the service account as the SYS user.
Make sure to
run the privilege script with the |
Create an Oracle Data Safe Service Account on Your Target Database Grant Roles to the Oracle Data Safe Service on a Non-Autonomous Database |
5 | Create an Oracle Data Safe private endpoint. | Create an Oracle Data Safe Private Endpoint |
6 | Add the security certificate for the Amazon RDS specific region | Add the Security Certificate for the Amazon RDS Specific Region |
7 | TLS connection only: Create a wallet or certificate | Create a Wallet or Certificates for a TLS Connection |
Run the Amazon RDS for Oracle Wizard
This is the Amazon RDS for Oracle registration workflow in the wizard:
Step 1: Target Information
- On the Overview page in the Oracle Data Safe
service, find the Register Amazon RDS for Oracle
tile and click Start Wizard.
The wizard displays the Data Safe Target Information form.
- At DATA SAFE TARGET DISPLAY NAME, enter a target display name that is meaningful to you. Data Safe uses this name in its reports. All characters are accepted. The maximum number of characters is 255.
- At COMPARTMENT, use the drop-down menu to select the compartment where you want to store the target database.
- (Optional) In the DESCRIPTION field, add a description that is meaningful to you.
- At DATABASE SERVICE NAME, enter the service name of the CDB or PDB.
You can use the database name on the Configuration tab of the RDS Amazon console for service name.
- Enter the
Database IP address/endpoint.
Tip:
For registration via private endpoint, an IP address should be provided. - Enter the Database port
number.
The port number can be found under the Connectivity and Security tab of the Amazon RDS console.
- Perform this step if you did not
already granted roles to the database user in the preregistration
tasks.
Click Download Privilege Script and save the
datasafe_privileges.sql
script to your computer. The script includes instructions on how to use it to grant privileges to the Oracle Data Safe service account on your target database. You should also refer to the preregistration task Grant Roles to the Oracle Data Safe Service on a Non-Autonomous Database for some additional details. - At DATABASE USERNAME and DATABASE PASSWORD, enter the name and password of the user you created in the preregistration tasks. If the user name is mixed case, enclose it in double-quotes (" "). Oracle Data Safe uses this account to connect to the target database.
- Click Next.
Step 2: Connectivity Option
If you have already setup network peering, such as through FastConnect or VPN Connect, that allows you to access your Amazon RDS for Oracle database from a virtual cloud network (VCN) in OCI, then you can leverage that connection and register your database via a Data Safe private endpoint. The private endpoint essentially represents the Oracle Data Safe service in your VCN with a private IP address in a subnet of your choice.
- Select Private endpoint as your connectivity option.
Note:
If you select Private Endpoint, then if the database is configured with a private IP address and an Oracle Data Safe private endpoint is already configured for the VCN of the database, that private endpoint is automatically selected. (You can have only one Oracle Data Safe private endpoint per VCN.) -
Select either TCP or TLS connection.
If you select TLS connection, you are presented with two options: One way TLS and Mutual TLS. If you select One way TLS, then do the following:
- Upload the TrustStore of your database in the format of PEM file, PKCS#12 wallet, or JKS wallet and optionally, enter the wallet password. This file is required whether client authentication is enabled or disabled on your target database.
- Upload the TrustStore of your database in the format of PEM file, PKCS#12 wallet, or JKS wallet and enter the wallet password. This file is required whether client authentication is enabled or disabled on your target database.
- When client authentication is enabled on your target database, upload the KeyStore of your database in the format of PEM file, PKCS#12 wallet, or JKS wallet. This file is not required when client authentication is disabled.
If you select
TCP
at TCP/TLS, you are not prompted for any additional details.Note:
In your AWS environment you will need to:- Configure SSL option group to enable SSL connection. After enabling the SSL connection, the certificate authority would show up. See Oracle Secure Sockets Layer and Creating an option group from Amazon to learn how to enable the SSL option.
- Modify the inbound rules on port 2484 (opened by default) on Amazon RDS to allow for TLS connection
- From the Select Private Endpoint, use the drop-down menu to select the private endpoint that you want to use.
- Click Next.
Step 3: Add Security Rule
An egress rule is required if you configure Amazon RDS for Oracle to use an Oracle Data Safe private endpoint. The egress rule allows the Oracle Data Safe private endpoint (from any port) to send requests to the database IP address(es) on the database's port.
- At Do you want to add the security rules now? , select
Yes.
If you select No, you can then click Next to bypass the egress rule selection and proceed to Step 4: Review and Submit. You can configure the egress rule later in the Oracle Cloud Infrastructure console (under Networking). Note that the target database remains inactive in Oracle Data Safe until the egress rule is configured either in the Oracle Data Safe wizard or on the Oracle Cloud Infrastructure Console.
- Select either Security List or Network Security Group (recommended) for where the egress security rule should be added to.
- Select the security list or network security group from the drop down.
The registration wizard will create the displayed egress rule in the selected list or group.
- Click Next.
See Also:
For more information about security lists and network security groups, see Access and Security in the Oracle Cloud Infrastructure documentation.Review and Submit
In this step, the wizard displays the configuration you entered in the previous steps. To change any of these settings, click the Edit button on the right side of the corresponding title.
- Review the information on this page.
- Click the checkbox, I acknowledge that charges in Data Safe will apply for the Amazon RDS for Oracle database.
- Click Register.
Registration Process
Important:
Do not click the Close button in the wizard, sign out of OCI, or close the browser tab until the wizard shows that all of the tasks listed are resolved. If you close prematurely, then the information for all of the tasks that have not yet been completed is lost and the target database is not registered.After You Submit the Registration
The wizard presents the Target Database
Details page when the registration submission is
finished. On this page, you can again review the registration
details. The wizard displays the NEEDS_ATTENTION
icon if a task must be performed or corrected before the process is
complete. A hint message indicates the pending task. You can make
the necessary changes in the tabs that are available. When you save
your changes, the UPDATING
icon is displayed. If
there is no further work to do, the registration completes.