Oracle Cloud Infrastructure Documentation

Cross-Region Data Guard Enablement

Review the prerequisites for enabling cross-region Data Guard when databases use cloud service provider (CSP) key management solutions.

Note

Oracle currently supports the following cloud service provider key management services for managing Transparent Data Encryption (TDE) master encryption keys when configuring cross-region Data Guard:

  • Microsoft Azure: Azure Key Vault (Standard and Premium) and Managed HSM
  • Google Cloud: Customer-Managed Encryption Keys (CMEK)
  • AWS: AWS Key Management Service (KMS) and CloudHSM

Parent topic: How-to Guides

Prerequisites

Ensure that the following requirements are met before configuring Cross-Region Data Guard.

Key Management and Replication Requirements

The encryption key resource must be replicated from the source region to the destination region. Depending on the key management service used, this includes replicating the vault, key ring, or encryption key.

VM Cluster Configuration Requirements

The VM cluster hosting the standby database must meet the following requirements:

  • An identity connector must be created (applicable when using Azure Key Vault).
  • Cloud service provider key management must be enabled for the VM cluster using one of the supported services:
    • Azure Key Vault (AKV)
    • Google Cloud Customer-Managed Encryption Keys (CMEK)
    • AWS Key Management Service (AWS KMS)

For detailed configuration steps, see the following sections:

Additional Disaster Recovery Guidance

For information about implementing cross-region disaster recovery using Active Data Guard with multicloud deployments, refer to the following solution guides:

Restrictions

Be aware of the following limitations:

  • The source and destination container databases (CDBs) must use the same TDE master encryption key.
  • Refreshable clone PDBs are not supported on the standby database

Replicate Key Resources Across Regions

Before replicating encryption resources across regions, ensure that all prerequisites are met.

  1. Open the navigation menu.
  2. Click Oracle AI Database, then Database Multicloud Integrations, and then one of the following:
    • Microsoft Azure Integration
    • Google Cloud Integration
    • AWS Integration

To replicate an Azure Key Vault

  1. Click Azure Key Vaults.
  2. Select required vault from the list.
  3. From the Actions menu, select Replicate Azure key vault.
  4. Select the target region.
  5. Click Replicate.

    After the operation completes, you can view the replicated key vault details, including the region and replication status, in the Cross-region Replications tab.

To replicate a GCP Key Ring

  1. Click GCP Key Rings.
  2. Select required key ring from the list.
  3. From the Actions menu, select Replicate GCP key ring.
  4. Select the target region.
  5. Click Replicate.

    After the operation completes, you can view the replicated key ring details, including the region and replication status, in the Cross-region Replications tab.

To replicate an AWS Key

  1. Click AWS Keys.
  2. Select required key from the list.
  3. From the Actions menu, select Replicate AWS Key.
  4. Select the target region.
  5. Click Replicate.

    After the operation completes, you can view the replicated key details, including the region and replication status, in the Cross-region Replications tab.

Delete Replicated Encryption Resources

Delete replicated encryption resources only after confirming that no active associations or dependencies exist.

  1. Open the navigation menu.
  2. Click Oracle AI Database, then Database Multicloud Integrations, and then one of the following:
    • Microsoft Azure Integration
    • Google Cloud Integration
    • AWS Integration

To delete an Azure Key Vault

  1. Click Azure Key Vaults.
  2. Select the compartment.

    List of vaults are displayed.

  3. Select the vault you're interested in.
  4. From the Actions menu, select Delete.
  5. In the confirmation dialog box, enter DELETE to confirm the action.
  6. Click Delete.

To delete a GCP Key Ring

  1. Click GCP Key Rings.
  2. Select the compartment.

    List of GCP Key Rings are displayed.

  3. Select the Key Ring you're interested in.
  4. From the Actions menu, select Delete.
  5. In the confirmation dialog box, enter DELETE to confirm the action.
  6. Click Delete.

To delete an AWS Key

  1. Click AWS Keys.
  2. Select the compartment.

    List of AWS Keys are displayed.

  3. Select the AWS Key you're interested in.
  4. From the Actions menu, select Delete.
  5. In the confirmation dialog box, enter DELETE to confirm the action.
  6. Click Delete.

Encryption Resource Deletion Guidelines

Guidelines for deleting replicated and non-replicated encryption resources across multiple cloud service providers, based on their association and replication status.

Non-Replicated Encryption Resource

Azure Key Vault

An Azure Key Vault cannot be deleted if it has active Identity Connector associations.

To proceed:

  1. Identify Identity Connector association(s) referencing Azure Key Vault <OCID> in <REGION>.
  2. Remove the association(s), or reassign dependent resources to a different Key Vault.
  3. Retry the delete operation.

Google Cloud KMS (Customer-Managed Encryption Key, CMEK)

A GCP Key Ring cannot be deleted if it contains keys actively associated with resources (for example, databases created using CMEK).

To proceed:

  1. Identify resources currently using keys from the Key Ring.
  2. Reconfigure those resources to use a different encryption key, or delete the dependent resources.
  3. Retry the delete operation once all associations are removed.

AWS Key Management Service (AWS KMS)

An AWS KMS key cannot be deleted if it has active associations (for example, databases encrypted using AWS KMS).

Note

AWS KMS keys are not deleted immediately; they must be scheduled for deletion and are subject to a mandatory waiting period.

To proceed:

  1. Identify resources currently encrypted with the KMS key.
  2. Reconfigure or delete the dependent resources.
  3. Schedule the key for deletion once all dependencies are removed.

Key Takeaways

  • Always check for active associations before attempting deletion.
  • Replicated resources require additional care since associations may exist across primary and standby regions.
  • Non-replicated resources follow cloud-provider–specific rules and cannot be deleted until dependencies are cleared.

Replicated Encryption Resource

You can delete a replicated encryption resource from either the primary region or a standby region.

  • Deletion from the primary region:

    The resource is deleted from the primary region and automatically removed from all associated standby (replicated) regions.

  • Deletion from a standby region:

    The resource is deleted only from the selected standby region. The resource remains unchanged in the primary region and any other standby regions.

Lifecycle States of Replicated Encryption Resources

A replicated encryption resource can be in one of the following lifecycle states.

  • CREATING: The replicated encryption resource is being created.
  • ACTIVE: The replicated encryption resource has been successfully created and is operational.
  • UPDATING: The replicated encryption resource is being modified.
  • DELETING: The replicated encryption resource is in the process of being deleted.
  • DELETED: The replicated encryption resource has been deleted and is no longer available.
  • FAILED: The replicated encryption resource operation failed. Review the associated logs or error messages for more information.

Enable Data Guard for Databases using Azure, Google Cloud, and AWS Key Management Services

Before enabling Data Guard, verify the key management configuration on the primary database.

  1. Navigate to the Database Details page of the primary database where you plan to enable Data Guard.
  2. In the Encryption section, review the values under Key Management.

Confirm the values based on your configured key management service:

  • If using Azure Key Vault
    • Key Management: Azure Key Vault
    • Vault: Vault name
    • Key: Key value
  • If using Google Cloud CMEK
    • Key Management: GCP Customer-Managed Encryption Key (CMEK)
    • Key Ring: Key ring value
    • Key: Key value
  • If using AWS KMS
    • Key Management: AWS Customer-Managed Key (CMK)
    • Key: Key value

For the generic Data Guard enablement procedure, see To Enable Data Guard on an Exadata Cloud Infrastructure System.