The Oracle Secure Backup Cloud Module is part of the Oracle Secure Backup product family and provides the flexibility to back up your Oracle Database to the Amazon S3 Cloud and to tape. With this cloud offering, local disk backups are sent directly to Amazon S3 for offsite storage and are fully integrated with Recovery Manager (RMAN) features.

The Oracle Secure Backup Cloud Module efficiently handles the backing up of Oracle Databases to S3 storage. In addition, Oracle Secure Backup Cloud Module backups work with tools like Oracle Enterprise Manager and your customized RMAN scripts. The Oracle Secure Backup Cloud Module does not back up operating system files.

The Oracle Secure Backup Cloud Module uses the RMAN SBT (System Backup to Tape) interface to extend the Amazon S3 functionality for Oracle backup operations. The Oracle Secure Backup Cloud Module offers an easy-to-manage, cost efficient, and scalable alternative to maintaining in-house data storage and managing a local, fully configured backup infrastructure.

The Oracle Secure Backup Cloud Module has several advantages over traditional tape-based offsite backups:

• Continuous Accessibility

  Oracle Secure Backup Cloud Module backups stored on Amazon S3 storage are always accessible. The cloud storage services availability and access model helps an organization to streamline recovery operations. For example, there is no need to ship or load tapes before a restore can be performed. You can still use familiar and standard tools like Enterprise Manager and your organization's current scripts continue to execute backup and restore tasks. With the ability to continually and easily access backups, the time spent restoring backups may be substantially reduced.

• Improved Reliability

  Because S3 storage is disk based, it is inherently more reliable than tape media. Internet storage service providers keep multiple, redundant copies of your data for availability and scalability purposes and the benefit of this practice to your organization and your data is increased reliability.

Before you can use the Oracle Secure Backup Cloud Backup Module and access Amazon S3, you must create an AWS account. The account requires that you provide a means of payment for Amazon to charge for your AWS S3 usage.

1. Visit https://aws.amazon.com/ to create an AWS account.
2. After you log in to your AWS account, click My Account and select Security Credentials to obtain your account details.
3. Use one of these methods to authenticate and access Amazon S3.

   • AWS Identifiers

     You obtain these credentials by going to the AWS website at http://aws.amazon.com, selecting My Account, and then AWS Management Console.

     You need the following mandatory AWS identifiers that are assigned when you create your AWS account: Access Key ID and Secret Access Key.

     Note: It is a good idea to secure these credentials since they authorize charges for all Amazon Web Services and enable access to RMAN backups stored on Amazon S3.

   • AWS IAM Role

     Enables Amazon Elastic Cloud Compute (EC2) instance users to leverage the metadata service. When the EC2 instance is configured with an IAM role, applications running on EC2 can use temporary credentials associated with the IAM role to create backups to Amazon S3. EC2 stores the temporary credentials in a predetermined location in JSON format. The installer retrieves the temporary credentials and stores them in the Oracle wallet.

     The IAM role must have the privileges required to access Amazon S3.

     Provide the following parameters to use IAM roles:

     • IAMRole (mandatory) - The AWS IAM Role name
     • IAMRoleMetaURI (optional) - Metadata URI for the specified IAM Role

     The OSB Cloud Module uses the Instance Metadata Service (IMDS) to access the instance metadata from an Amazon EC2 instance. IMDS is available in two versions: IMDSv1 and IMDSv2. By default, the OSB Cloud Module uses IMDSv2 to support enhanced security for metadata access. If IMDSv2 is not accessible, then the OSB Cloud Module automatically falls back to use IMDSv1.

   Note:

   See IAM Roles for Amazon EC2 for more information.

Before you backup to Amazon S3 Cloud, you need to install the Oracle Secure Backup (OSB) Cloud Module on the target database server. The backup module installer file osbws_installer.zip is available in the Oracle home directory after you install the Oracle Database.

Configure an RMAN automatic SBT (tape) channel and specify the path to the SBT library that corresponds to Amazon Web Services. You can optionally configure the SBT channel as the default channel so that RMAN can directly make all backups to Amazon S3 storage.

1. Start RMAN and connect to the target database.
2. Use the CONFIGURE command to configure an automatic SBT channel. Use the SBT_LIBRARY parameter to specify the absolute path to the SBT library file for RMAN operations with Amazon S3.
   • UNIX and Linux
   • Windows

   RMAN> CONFIGURE CHANNEL DEVICE TYPE 'SBT'
   PARMS 'SBT_LIBRARY=$ORACLE_HOME/lib/libosbws.so, 
   ENV=(OSB_WS_PFILE=/myfiles/osbsws<ORACLE_SID>.ora)';

   RMAN> CONFIGURE CHANNEL DEVICE TYPE 'SBT'
   PARMS 'SBT_LIBRARY=%ORACLE_HOME%\bin\oraosbws.dll, 
   SBT_PARMS=(OSB_WS_PFILE=C:\myfiles\osbsws<ORACLE_SID>.ora)';

   This example configures an automatic SBT channel to send backups to Amazon S3. The SBT_LIBRARY parameter specifies the path of the native SBT library that corresponds to Amazon S3 Cloud. osbswsORACLE_SID.ora is the Oracle Secure Backup configuration file that is created when you install the Oracle Secure Backup Cloud module. <ORACLE_SID> is the system identifier of the target Oracle Database which you want to back up to AWS Cloud.

   Note:

   • On Windows systems, use the SBT_PARMS parameter instead of the ENV parameter to specify the configuration file.
   • You can skip the ENV or SBT_PARMS parameter if the configuration file is created in the default directory chosen by the backup module installer.
   • An automatic SBT channel creates a persistent default SBT device setting that applies to all backup and recovery operations. Alternatively, you can use the ALLOCATE CHANNEL command to manually allocate a one-time SBT channel before each backup or restore operation.
   Review the sample output of the CONFIGURE command.

   
   CONFIGURE CHANNEL DEVICE TYPE 'SBT_TAPE' PARMS  'SBT_LIBRARY=/orclhome/lib/libosbws.so, ENV=(OSB_WS_PFILE=/myfiles/osbwssbt.ora)';
   new RMAN configuration parameters are successfully stored

3. Configure SBT as the default device type if you want to create all backups to Amazon S3 by default.

   RMAN> CONFIGURE DEFAULT DEVICE TYPE TO SBT;
   

   
   CONFIGURE DEFAULT DEVICE TYPE TO SBT;
   new RMAN configuration parameters:
   CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
   new RMAN configuration parameters are successfully stored
   

4. Use the SHOW ALL CHANGED command to review the RMAN configuration and to confirm that you have set Amazon S3 as the backup destination.

   RMAN> SHOW ALL CHANGED;
   
   SHOW ALL CHANGED;
   RMAN configuration parameters for database with db_unique_name TEST are:
   CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
   CONFIGURE CHANNEL DEVICE TYPE 'SBT_TAPE' PARMS  'SBT_LIBRARY=/orclhome/lib/libosbws.so, ENV=(OSB_WS_PFILE=/myfiles/osbwssbt.ora)';
   

Connect RMAN to your target database and perform backup and restores with Amazon S3 Cloud.

1. Start RMAN and connect to the target database.
2. Run the SHOW ALL CHANGED command to verify that the RMAN environment is configured for backups with Amazon S3.

   RMAN> SHOW ALL CHANGED;

   This sample RMAN configuration shows that the SBT channel specifies the /orclhome/lib/libosbws.so SBT library path (on UNIX and Linux) which corresponds to Amazon S3 Cloud. The default device type is set to SBT_TAPE which indicates that all backups are directly sent to Amazon S3.

   
   SHOW ALL CHANGED;
   RMAN configuration parameters for database with db_unique_name TEST are:
   CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
   CONFIGURE CHANNEL DEVICE TYPE 'SBT_TAPE' PARMS  'SBT_LIBRARY=/orclhome/lib/libosbws.so, ENV=(OSB_WS_PFILE=/oracle/dbs/osbwssbt.ora)';
   

3. Use RMAN to backup the database to Amazon S3 Cloud using RMAN.

   BACKUP DATABASE;

   RMAN> backup database;
   backup database;
   Starting backup at 11-MAR-25
   allocated channel: ORA_SBT_TAPE_1
   channel ORA_SBT_TAPE_1: SID=211 device type=SBT_TAPE
   channel ORA_SBT_TAPE_1: Oracle Secure Backup Web Services Library VER = 26.0.0.1
   allocated channel: ORA_SBT_TAPE_2
   channel ORA_SBT_TAPE_2: SID=25 device type=SBT_TAPE
   channel ORA_SBT_TAPE_2: Oracle Secure Backup Web Services Library VER = 26.0.0.1
   allocated channel: ORA_SBT_TAPE_3
   channel ORA_SBT_TAPE_3: SID=212 device type=SBT_TAPE
   channel ORA_SBT_TAPE_3: Oracle Secure Backup Web Services Library VER = 26.0.0.1
   channel ORA_SBT_TAPE_1: starting full datafile backup set
   .
   .
   .
   channel ORA_SBT_TAPE_1: backup set complete, elapsed time: 00:01:01
   channel ORA_SBT_TAPE_2: finished piece 1 at 11-MAR-25
   piece handle=1j8qmc28_51_1_1 tag=TAG20250311T063959 comment=API Version 2.0,MMS Version 26.0.0.1
   channel ORA_SBT_TAPE_2: backup set complete, elapsed time: 00:00:45
   channel ORA_SBT_TAPE_3: finished piece 1 at 11-MAR-25
   piece handle=1e0mmbu0_46_1_1 tag=TAG20250311T063959 comment=API Version 2.0,MMS Version 26.0.0.1
   channel ORA_SBT_TAPE_3: backup set complete, elapsed time: 00:03:01
   Finished backup at 11-MAR-25
   Starting Control File Autobackup at 11-MAR-25
   piece handle=c-3829255431-20250311-01 comment=API Version 2.0,MMS Version 26.0.0.1
   Finished Control File Autobackup at 11-MAR-25
   

4. Restore and recover the database with Amazon S3 using RMAN.

   RESTORE DATABASE;
   RECOVER DATABASE;

This section lists potential issues that may affect the installation or the operation of the Oracle Secure Backup Cloud Module.