AWS Key Management Service Integration for Exadata Database Service on Oracle Database@AWS

OCI Identity domain is automatically configured during the Oracle Database@AWS onboarding process, and no action is required. Complete the following steps only for accounts that were linked before the general availability of AWS KMS integration (November 18, 2025).

Configure an OCI identity domain to enable AWS integration for your Exadata VM Clusters. It allows you to associate an AWS Identity and Access Management (IAM) service role with AWS integrations.

1. From the AWS console, select Oracle Database@AWS, and then select Settings.
2. Select the Configure button to configure your OCI identity domain.
3. Once it is complete, you can review the Status, OCI identity domain ID and OCI identity domain URL information from the Settings page.

1. If you do not have an existing ODB Network, you can provision one by following the ODB Network step-by-step instructions. If you have an existing ODB Network, you can modify it by selecting the Modify button, follow Modify an ODB Network for step-by-step instructions.
2. From the Configure service integrations section,
   1. Select the Security Token Service (STS) option to setup the networking for AWS KMS and AWS STS access from the database.
   2. Select the AWS KMS checkbox to enable AWS KMS to use KMS keys in your authentication polices.

Exadata VM Cluster creation is only available through the AWS Console and AWS CLI. For more information, see Exadata VM Cluster.

Create a stack for each cluster. Use the following steps to create a CloudFormation stack. This needs to be performed for each Exadata VM cluster.

When your CloudFormation stack creates an OIDC (OpenID Connect) Provider, it establishes a trust relationship so that an external identity source (like OCI) can authenticate to AWS. The associated IAM Role defines what that trusted identity is allowed to do.

1. Select your existing Exadata VM Cluster from the list to open its details page in the AWS Management Console.
   Note
   
   

   If you do not have an existing Exadata VM Cluster, you can provision one by following the Exadata VM Cluster step-by-step instructions.

2. Select the IAM service roles tab and then click the CloudFormation link.
3. From the Quick create stack page, review the pre-filled information.
   1. Under the Parameters section, parameters are defined in your template and allow you to enter custom values when you create or update a stack.
      1. Review your pre-filled OCIIdentityDomainUrl information.
      2. The OIDCProviderArn field is optional. When you create the CloudFormation stack for the first time, it creates an OIDC Provider and an associated IAM Role. If you are executing the stack for the first time, you do not need to provide a value for the OIDCProviderArn field.
      3. For any additional execution time, you must provide the ARN of the existing OIDC Provider and specify it in the OIDCProviderArn field. To obtain your OIDCProviderArn information, complete the following steps:
         1. From the AWS console, navigate to IAM, and then select Identity providers.
         2. From the Identity providers list, you can filter your provider selecting Type as OpenID Connect.
         3. Select the Provider link that was created when the CloudFormation stack was initially created.
         4. From the Summary page, copy the ARN information.
         5. Paste the ARN information into the OIDCProviderArn field.
   2. From the Permissions section, select IAM role name from the drop-down list, and then select the IAM role for CloudFormation to use for all operations performed on the stack.
   3. Select the Create stack button to apply the changes.
4. After the CloudFormation stack deployment is complete, navigate to the Resources section of the stack and verify the created IdP and IAM Role resources. Copy the IAM Role ARN for future use.

You must attach an IAM role that you created previously to the Exadata VM Cluster to assign an identity connector that enables access to AWS resources.

1. From the AWS console, select Oracle Database@AWS.
2. From the left menu, select Exadata VM clusters, and then select your Exadata VM Cluster from the list.
3. Select the IAM roles tab, and then select the Associate button.
   1. The AWS integration field is read-only.
   2. Enter the Amazon Resource Name (ARN) of the IAM role you want to associate with the VM cluster in the Role ARN field. You can obtain the ARN information from the Summary section of the role that you previously created.
   3. Select the Associate button to attach the role.
      Note
      
      

      Once you associate an IAM role to your VM cluster, an identity connector gets attached to your Exadata VM Cluster.

Once you complete the prerequisites section, continue with the following actions:

1. From the AWS Console, create a customer-managed key in AWS KMS.
2. From the OCI Console, enable Exadata VM Cluster(s) and databases to utilize the AWS KMS key created in the step 1.

1. From the AWS console, select Key Management Service (KMS).
2. From the left menu, select Customer managed keys, and then select the Create key button.
3. In the Configure key section, enter the following information.
   1. Choose the Symmetric option as the Key type.
   2. Choose the Encrypt and decrypt option as the Key usage.
   3. Expand the Advanced options section. Both AWS KMS and AWS CloudHSM are supported.
      1. If you want to use KMS standard key store, choose the KMS - recommended option as Key material origin, and then choose either the Single-Region key option or the Multi-Region key option from the Regionality section.
      2. If you want to use AWS CloudHSM , choose the AWS CloudHSM key store option as Key material origin.
   4. Select the Next button to continue the creation process.
4. In the Add labels section, enter the following information.
   1. Enter a descriptive display name in the Alias field. Maximum 256 characters. Use alphanumeric and '_-/' characters.
      Note
      
      

      • The alias name cannot begin with aws/. The aws/ prefix is reserved by AWS to represent AWS managed keys in your account.
      • An alias is a display name that you can use to identify the KMS key. We recommend that you choose an alias that indicates the type of data you plan to protect or the application you plan to use with the KMS key
      • Aliases are required when you create a KMS key in the AWS console.
   2. The Description field is optional.
   3. The Tags section is optional. You can use tags to categorize and identify your KMS keys and help you track your AWS costs.
   4. Select the Next button to continue the creation process or the Previous button to return the previous page.
5. In the Define key administrative permissions section, complete the following substeps.
   1. Search the role that you previously created, and then select the checkbox. Select the IAM users and roles that can administer the KMS key.
      Note
      
      

      This key policy gives the AWS account full control of this KMS key. It allows account administrators to use IAM policies to give other principals permission to manage the KMS key.

   2. From the Key deletion section, the Allow key administrators to delete this key checkbox is selected by default. To prevent the selected IAM users and roles from deleting the KMS key, you can deselect the checkbox.
   3. Select the Next button to continue the creation process or the Previous button to return the previous page.
6. In the Define key usage permissions section, complete the following substeps.
   1. Search the role that you previously created, and then select the check box.
   2. Select the Next button to continue the creation process or the Previous button to return the previous page.
7. In the Edit key policy section, complete the following substeps.
   1. From the Preview section, you can review the key policy. If you want to make a change, select the Edit tab.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "KMSKeyMetadata",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "<arn>"
                  },
                  "Action": [
                      "kms:DescribeKey"
                  ],
                  "Resource": "*"
              },
              {
                  "Sid": "KeyUsage",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "<arn>"
                  },
                  "Action": [
                      "kms:Encrypt",
                      "kms:Decrypt"
                  ],
                  "Resource": "*"
              }
          ]
      }

   2. Select the Next button to continue the creation process or the Previous button to return the previous page.
8. In the Review section, review your information and then select the Finish button.

For more information, see Create a symmetric encryption KMS key.

To enable AWS KMS for your Exadata VM Cluster(s), you must first register the AWS KMS key in OCI.

1. From the OCI console, select Oracle AI Database, and then select Database Multicloud Integrations.
2. Select AWS Integration, and then select AWS Keys.
3. Select Register AWS keys, and complete the following steps:
   1. From the Compartment dropdown list, select the compartment where your Exadata VM Cluster resides.
   2. Optionally, select a previously created key pool. For more information, see Create a Key Pool.
   3. If you select a key pool, ensure that its type matches the AWS key type:
      • A single-region AWS key must be added to a single-region key pool.
      • A multi-region AWS key must be added to a multi-region key pool.
   4. Under AWS keys, select your identity connector from the dropdown list.
      Note
      
      Ensure that the role associated with the identity connector has the DescribeKey permission on the AWS key. This permission is required for key discovery. For more information, see step 2 in Configure Identity Provider.
   5. Optionally, enter the key ARN in the Key ARN field.
   6. Select Discover.
4. Review the discovered keys listed in the results, select the keys you want to register, and then select Register.

Configure the required IAM policies based on the compartments containing the registered KMS resource and the Cloud VM cluster.

• If the KMS resource and Cloud VM cluster are in different compartments, configure two policies:
  • In the compartment containing the KMS resource, allow the Cloud VM cluster resource principal to read the registered KMS resource:

    Allow any-user to read oracle-db-aws-keys in compartment id <key-compartment-ocid>
    where all { request.principal.type = 'cloudvmcluster' }

  • In the compartment containing the Cloud VM cluster, authorize the same resource principal for the PKCS data-object creation flow:

    Allow any-user to read oracle-db-aws-keys in compartment id <vm-cluster-compartment-ocid>
    where all { request.principal.type = 'cloudvmcluster' }

• If the KMS resource and Cloud VM cluster are in the same compartment, configure only one policy in that compartment:

  Allow any-user to read oracle-db-aws-keys in compartment id <vm-cluster-compartment-ocid>
  where all { request.principal.type = 'cloudvmcluster' }

1. From the OCI Console, navigate to Oracle AI Database and then select Database Multicloud Integrations.
2. From the left menu, select AWS Integration and then select Key Pools.
3. Select the Create key pool button to create one.
   1. From the Create key pool page, complete the following steps.
   2. From the dropdown list, select the Compartment.
   3. Enter a descriptive name for your key pool. The Display name must contain only alphanumeric characters and hyphens ( - )and underscores ( _ ).
   4. The Allow key reuse toggle is enabled by default. Enable Allow key reuse to allow keys within the key pool to be reused for multiple databases. If disabled, one key can only be used for one database.
   5. The Multi-region key pool toggle is disabled by default. This is optional step. Enable Multi-region key pool to allow only Multi-region keys to be added to the key pool. If disabled, only single-region keys can be added to the key pool.
   6. The Tags section is an optional step. If you want to add a tag your resources, select the Add tag button.
4. Once the key pool is created, navigate back to the Key Pools page to view the State, Allow key reuse, Multi-region key pool and Created information.

1. From the OCI Console, navigate to Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select AWS Integration and then select Key Pools.
3. From the Key Pools list, select the key pool that you created previously.
4. Select the Keys tab. If you have not registered your AWS Key(s), register AWS Key(s) by selecting Register AWS keys button.
5. From the Register AWS keys page, complete the following steps:
   1. Select the Compartment which your AWS Key will be registered in.
      • The discovered keys will be added to the current key pool.
      • If the key pool selected is a multi-region key pool, only the multi-region keys from the discovered results are enabled and can be added to this key pool.
   2. From the Discover AWS keys using identity connector list, select an identity connector.
   3. Enter your AWS key ARN information in the Key name field.
   4. Select the Discover button.
   5. Expand the Advanced options section. This is an optional step. If you want to add a tag your resources, select the Add tag button.
   6. Review the discovered keys listed in the results, select the keys you want to add to the Key Pool, and then select Register.
6. Select the Add keys to key pool button to add your AWS Key(s) to your Key Pool.
   1. From the Add keys to key pool page, select your key(s).

      Select one or more existing AWS keys to add to the key pool. The list displays only keys that are in the current compartment and are not associated with another key pool.

   2. Select the Add button.

1. From the OCI Console, navigate to Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select AWS Integration and then select Key Pools.
3. In the Key Pools list, select the multi-Region key pool that you want to replicate.
4. From the Actions menu, select Replicate Key Pool.
5. In the Replicate Key Pool window, select the destination regions where you want to replicate the key pool and its keys.
6. Select Replicate.
7. Select the Cross-region replications tab to view the regions where the key pool has been replicated.

1. From the OCI Console, navigate to Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select AWS Integration and then select Key Pools.
3. In the Key Pools list, select the Key Pool that you created earlier.
4. To add a key to the Key Pool:
   1. Select the Keys tab, and then select Add keys to key pool.
   2. On the Add keys to key pool page, select a key from the dropdown list.
      Note
      
      

      • Only keys in the current compartment that are not assigned to another Key Pool are displayed.
      • For a single-Region Key Pool, only single-Region keys are displayed.
      • For a multi-Region Key Pool, only multi-Region keys are displayed.
   3. Select Save.
5. To remove a key from the Key Pool:
   1. Select the key that you want to remove.
   2. On the Details page, scroll to the Key Pool field, and select Delete.
   3. Enter DELETE in the confirmation field, and then select Delete.

      The key is removed from the Key Pool.

1. From the OCI Console, navigate to Oracle AI Database, and then select Database Multicloud Integrations.
2. From the left menu, select AWS Integration and then select Key Pools.
3. In the Key Pools list, select the Key Pool that you created earlier.
4. View the Key usage count based on the type of Key Pool:
   • Single-Region Key Pool: On the Details page, scroll to the Key usage count field.
   • Multi-Region Key Pool: Select the Keys tab, select the AWS KMS key that you want to review, and then scroll to the Key usage count field on the Details page.

Available Keys Below Threshold

The Key usage count field shows the number of active database resources currently using the AWS key. This count reflects key usage and does not indicate the number of available keys in the Key Pool.

The system displays the Available Keys Below Threshold warning when key reuse is false and fewer than 25% of the keys in the Key Pool are available for use. If the warning appears, add more keys to the Key Pool or enable key reuse in the Key Pool policy to help ensure that keys remain available for database operations.

When you enable AWS key management for your database, only AWS keys that are authorized for use with Exadata VM Cluster and registered with OCI can be used.

1. From the OCI console, select Oracle AI Database and then select Oracle Exadata Database Service on Dedicated Infrastructure.
2. From the left menu, select Exadata VM Clusters, and then select your Exadata VM Cluster.
3. Select the VM Cluster information tab, and select the Enable button next to AWS Customer Managed Encryption Key.

This topic describes only the steps for creating a database and using AWS KMS as the key management solution.

For the generic database creation procedure, see To create a database in an existing VM Cluster.

Prerequisites

Refer to Prerequisites.

Steps

If AWS KMS key management is enabled at the VM cluster level, you will have two key management options: Oracle Wallet and AWS key management.

1. In the Encryption section, choose AWS key management.
2. Select the Compartment and the Key pool from the dropdown list.
3. Select the Compartment and the Key from the dropdown list.
   Note
   
   

   • Only registered keys are listed.
   • If your desired key is not visible, it may not have been registered yet. Click Register AWS Keys to discover and register it.

     For detailed instructions, refer to Register AWS KMS Key.

   • You can select a key alias from the drop-down list. If no key alias is available, the drop-down list will display the key ID.

If you want to change the key management of your existing databases in the Exadata VM Cluster from Oracle Wallet to AWS KMS, complete the following steps.

1. From your Exadata VM Clusters, navigate to Databases tab, and then select the database that you are using.
2. From the Encryption section, confirm that Key management is set to Oracle Wallet, and then select the Change link.
3. From the Change key management page, enter the following information.
   1. Select your Key management as AWS key management from the dropdown list.
   2. Select the key compartment you are using, and then select the desired key from the dropdown list.
   3. Select the Save changes button.

To rotate the AWS KMS Key of a container database (CDB), use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM Clusters, click the name of the VM cluster that contains the database that you want to rotate encryption keys.
4. Click Databases.
5. Click the name of the database that you want to rotate encryption keys.

   The Database Details page displays information about the selected database.

6. In the Encryption section, verify that the Key Management is set to AWS key management, and then click the Rotate link.
7. On the resulting Rotate Key dialog, click Rotate to confirm the action.
   Note
   
   

   Rotating the AWS KMS key generates a new encryption context for the same key.

To rotate the AWS KMS Key of a pluggable database (PDB), use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM clusters, click the name of the VM cluster that contains the PDB you want to start, and then click its name to display the details page.
4. Under Databases, find the database containing the PDB you want to rotate encryption keys.
5. Click the name of the database to view the Database Details page.
6. Click Pluggable Databases in the Resources section of the page.

   A list of existing PDBs in this database is displayed.

7. Click the name of the PDB that you want to rotate encryption keys.

   The pluggable details page is displayed.

8. In the Encryption section displays that the Key management is set as AWS key management.
9. Click the Rotate link.
10. On the resulting Rotate Key dialog, click Rotate to confirm the action.
    Note
    
    

    Rotating the AWS KMS key generates a new encryption context for the same key.

Optionally, complete the following steps to disable a specific CDB or PDB key.

1. Navigate to the AWS console, select Key Management Service (KMS).
2. From the left menu, select Customer managed keys, and then select the Key ID of the key that you want to edit.
3. Select the Edit policy button.
4. Run the following query to obtain the EncryptionContext MKID of the key.

   Use the following command to view the current master key IDs (MKIDs) for enabling or disabling operations:

   dbaascli tde getHSMKeys --dbname <DB-Name>

   You can also run the following SQL query to list all key versions:

   SELECT key_id, con_id, creation_time, key_use FROM v$encryption_keys;

5. Add a deny policy using the retrieved EncryptionContext MKID as shown below:

   {
     "Effect": "Deny",
     "Principal": "*",
     "Action": [
       "kms:Encrypt",
       "kms:Decrypt"
     ],
     "Resource": "arn:aws:kms:us-east-1:867344470629:key/7139075d-a006-4302-92d5-48ecca31d48e",
     "Condition": {
       "StringEquals": {
         "kms:EncryptionContext:MKID": "ORACLE.TDE.HSM.MK.06AE5EFB528D9D4F21BFEDA63C6C8738D9"
       }
     }
   }

6. Choose Save changes to apply the policy update.

• Support for keypool.
• Various bug fixes and stability improvements.

• Various bug fixes and stability improvements.

• Various bug fixes and stability improvements.

• Various bug fixes and stability improvements.