AWS odb documentation change
Summary
Added documentation for configuring ODB peering connections (including cross-account) and AWS Cloud WAN integration, including CLI examples and network setup details.
Security assessment
The changes introduce documentation for AWS Cloud WAN, highlighting network segmentation and policies which are security features. However, there's no evidence of addressing a specific security vulnerability. The cross-account peering setup using AWS RAM is a standard procedure without explicit security context.
Diff
diff --git a/odb/latest/UserGuide/configuring.md b/odb/latest/UserGuide/configuring.md index 6175b842e..a48185c85 100644 --- a//odb/latest/UserGuide/configuring.md +++ b//odb/latest/UserGuide/configuring.md @@ -5 +5 @@ -Configuring VPC route tables for ODB peeringConfiguring DNSConfiguring Amazon VPC Transit Gateways for Oracle Database@AWS +Setting up ODB peeringConfiguring VPC route tables for ODB peeringConfiguring DNSConfiguring Amazon VPC Transit Gateways for Oracle Database@AWSConfiguring AWS Cloud WAN for Oracle Database@AWS @@ -9 +9 @@ Oracle Database@AWS is in preview release and is subject to change. -# Configuring the network in Oracle Database@AWS +# Configuring ODB peering to an Amazon VPC in Oracle Database@AWS @@ -11 +11,58 @@ Oracle Database@AWS is in preview release and is subject to change. -If you specified a VPC for ODB peering to your ODB network, make sure to update your VPC route tables and configure DNS resolution. For more information about ODB peering, see [ODB peering](./how-it-works.html#how-it-works.peering). + _ODB peering_ is a user-created network connection that enables traffic to be routed privately between an Amazon VPC and an ODB network. There is a one-to-one relationship between a VPC and an ODB network. After you create a peering connection using the console, CLI, or API, make sure to update your VPC route tables and configure DNS resolution. For a conceptual overview of ODB peering, see [ODB peering](./how-it-works.html#how-it-works.peering). + +## Creating an ODB peering connection in Oracle Database@AWS + +With ODB peering connections, you can establish private network connectivity between your Oracle Exadata infrastructure and applications running in your Amazon VPCs. Each ODB peering connection is a separate resource that you can create, view, and delete independently of the ODB network. + +You can create the following types of ODB peering connections: + +**Same-account ODB peering** + + +You can create an ODB peering connection between an ODB network and an Amazon VPC in the same AWS account. + +**Cross-account ODB peering** + + +You can create an ODB peering connection between an ODB network in one account and an Amazon VPC in a different account, after the ODB network has been shared using AWS RAM. + +There is a 1:1 relationship between a VPC and an ODB network. You can't create an ODB peering connection between a VPC and multiple ODB networks or between an ODB network and multiple VPCs. + + 1. Sign in to the AWS Management Console and open the Oracle Database@AWS console at [https://console.aws.amazon.com/odb/](https://console.aws.amazon.com/odb/). + + 2. In the navigation pane, choose **ODB peering connections**. + + 3. Choose **Create ODB peering connection**. + + 4. (Optional) For **ODB peering name** , enter a unique name for your connection. + + 5. For **ODB network** , choose the ODB network to peer. + + 6. For **Peer network** , choose the Amazon VPC to peer with your ODB network. + + 7. (Optional) In **Tags** , add a key and value pair. + + 8. Choose **Create ODB peering connection**. + + + + +After creating an ODB peering connection, configure your Amazon VPC route tables to route traffic to the peered ODB network. For more information, see Configuring VPC route tables for ODB peering. Note that Oracle Database@AWS automatically configures the ODB network route tables. + +To create an ODB peering connection, use the `create-odb-peering-connection` command. + + + aws odb create-odb-peering-connection \ + --odb-network-id odbnet-1234567890abcdef \ + --peer-network-id vpc-abcdef1234567890 + +To list your ODB peering connections, use the `list-odb-peering-connections` command. + + + aws odb list-odb-peering-connections + +To get details about a specific ODB peering connection, use the `get-odb-peering-connection` command. + + + aws odb get-odb-peering-connection \ + --odb-peering-connection-id odbpcx-1234567890abcdef @@ -17 +74 @@ A _route table_ contains a set of rules, called _routes_ , that determine where -To update a route table, use the AWS CLI command `ec2 create-route` as follows: +To update a route table, use the AWS CLI `ec2 create-route` command. The following examples updates Amazon VPC route tables. For more information, see Configuring VPC route tables for ODB peering. @@ -20,4 +77,4 @@ To update a route table, use the AWS CLI command `ec2 create-route` as follows: - aws ec2 create-route - --route-table-id route-table-id - --destination-cidr-block cidr-block - --odb-network-arn odb-network-arn + aws ec2 create-route \ + --route-table-id rtb-1234567890abcdef \ + --destination-cidr-block 10.0.0.0/16 \ + --odb-network-arn arn:aws:odb:us-east-1:111111111111:odb-network/odbnet_1234567890abcdef @@ -224,0 +282,50 @@ In AWS Transit Gateway, you're charged for the number of connections that you ma +## Configuring AWS Cloud WAN for Oracle Database@AWS + +AWS Cloud WAN is a managed wide-area networking (WAN) service. You can use AWS Cloud WAN to build, manage, and monitor a unified global network that connects resources running across your cloud and on-premises environments. + +In AWS Cloud WAN, a _global network_ is a single, private network that acts as the high-level container for your network objects. A _core network_ is the part of your global network managed by AWS. + +AWS Cloud WAN provides the following key benefits: + + * Centralized network management that simplifies operations while maintaining security across multiple Regions + + * Core networks with built-in segmentation to isolate traffic through multiple routing domains + + * Support for policies to automate network management and define consistent configurations across your global network + + + + +In Oracle Database@AWS, an ODB network supports peering to only one VPC. If you connect a AWS Cloud WAN core network to a peered VPC, it enables global traffic routing. Applications in attached VPCs across multiple regions can access Exadata VM clusters in your ODB network. You can isolate ODB network traffic in its own segment or enable access to other segments. + +AWS Cloud WAN doesn't offer native integration to use an ODB network as an attachment. Therefore, VPC features such as the following aren't available: + + * Resolution of public DNS hostnames to private IP addresses + + * Event notification for changes in the ODB network topology, routing, and connection status + + + + +In AWS Cloud WAN, you're charged hourly for the following: + + * Number of Regions (core network edges) + + * Number of core network attachments + + * The amount of traffic that flows through your core network through the attachments + + + + +For detailed pricing information, see [AWS Cloud WAN pricing](https://aws.amazon.com/cloud-wan/pricing/). + +###### To configure a core network for Oracle Database@AWS + + 1. Add CIDR ranges to your ODB network for the VPCs and on-premises networks that you plan to attach to your core network. For more information, see [Updating an ODB network in Oracle Database@AWS](./managing.html#managing.updating). + + 2. Follow the steps in [Create an AWS Cloud WAN global network and core network](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-getting-started.html). + + + + @@ -233 +340 @@ Getting started -Managing +Service integrations with VPC Lattice