AWS odb medium security documentation change
Summary
Added service integrations section with Amazon S3 access policies and automatic backup preconfiguration
Security assessment
Introduces security documentation around S3 access policies ('You can enter a JSON policy') and automatic backup security ('preconfigures access for Oracle managed automatic backups to Amazon S3'), which directly relates to access control and data protection mechanisms.
Diff
diff --git a/odb/latest/UserGuide/getting-started.md b/odb/latest/UserGuide/getting-started.md index dcb579af4..daa2ae7e2 100644 --- a//odb/latest/UserGuide/getting-started.md +++ b//odb/latest/UserGuide/getting-started.md @@ -5 +5 @@ -PrerequisitesLimitationsPlanning IP address spaceStep 1: Create an ODB networkStep 2: Create an Oracle Exadata infrastructureStep 3: Create an Exadata VM clusterStep 4: Create Oracle Exadata databases +PrerequisitesSupported RegionsPlanning IP address spaceStep 1: Create an ODB networkStep 2: Create an Oracle Exadata infrastructureStep 3: Create a VM clusterStep 4: Create Oracle Exadata databases @@ -11 +11 @@ Oracle Database@AWS is in preview release and is subject to change. -To begin using Oracle Database@AWS, you create an ODB network, Oracle Exadata infrastructure, and VM cluster. You can then create Oracle Exadata databases using the Oracle Cloud Infrastructure console or APIs. +To begin using Oracle Database@AWS, you can create the following resources using the Oracle Database@AWS console, CLI, or APIs: @@ -13 +13 @@ To begin using Oracle Database@AWS, you create an ODB network, Oracle Exadata in -## Prerequisites for setting up Oracle Database@AWS + 1. ODB network @@ -15 +15 @@ To begin using Oracle Database@AWS, you create an ODB network, Oracle Exadata in -Before configuring your Oracle Exadata infrastructure, make sure that you perform the steps in [Onboarding to Oracle Database@AWS](./setting-up.html). You must have accepted a private offer to use Oracle Database@AWS. + 2. Oracle Exadata infrastructure @@ -17 +17 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor -## Limitations for Oracle Database@AWS + 3. Exadata VM cluster or Autonomous VM cluster @@ -19 +19 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). The only supported physical AZs within this Region have the physical IDs `use1-az4` and `use1-az6`. To find the logical zone names in your account that map to the physical zone IDs, run the following command. + 4. ODB peering connection @@ -21 +20,0 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - aws ec2 describe-availability-zones --region us-east-1 --query "AvailabilityZones[*].{ZoneName:ZoneName, ZoneId:ZoneId}" @@ -24 +22,0 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can deploy a VM cluster only into the AZ where you created your ODB network and Oracle Exadata infrastructure. @@ -26 +24 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * The subnet in the VPC or applications connecting to Oracle Database@AWS must be in AZ `use1-az6` or `use1-az4`. +To create Oracle Exadata databases on your infrastructure, you must use the Oracle Cloud Infrastructure (OCI) console or APIs rather than the Oracle Database@AWS dashboard. Thus, you deploy resources in two cloud environments: network and infrastructure resources are in AWS, while the database administration control plane is in OCI. For more information, see [Oracle Database@AWS](https://docs.oracle.com/en-us/iaas/Content/database-at-aws/oaaws.htm) in the Oracle Cloud Infrastructure documentation. @@ -28 +26 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * Your AWS account has the following limitations for Oracle Database@AWS: +## Prerequisites for setting up Oracle Database@AWS @@ -30 +28 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * By default, you can create only 5 ODB networks in an AWS account. +Before configuring your Oracle Exadata infrastructure, make sure that you perform the steps in [Onboarding to Oracle Database@AWS](./setting-up.html). You must have accepted a private offer to use Oracle Database@AWS. @@ -32 +30 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * By default, you can create only 10 ODB peering connections in an AWS account. +## Supported Regions for Oracle Database@AWS @@ -34 +32 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can't share Oracle Exadata infrastructure across AWS accounts. +You can use Oracle Database@AWS in the following AWS Regions: @@ -36 +34 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * VM clusters must be in the same AWS account as the Oracle Exadata infrastructure. +**US East (N. Virginia)** @@ -38 +35,0 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can deploy only VM clusters in your ODB network. No other resources are permitted. @@ -40 +37 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can't create an ODB peering connection between a VPC and multiple ODB networks or between an ODB network and multiple VPCs in the same AWS account. There is a 1:1 relationship between a VPC and an ODB network. +You can use the AZs with the physical IDs `use1-az4` and `use1-az6`. @@ -42 +39 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * IPv6 isn't supported for Oracle Exadata X9M. +**US West (Oregon)** @@ -44 +40,0 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor - * You can't change the storage allocation after you create a VM cluster. @@ -45,0 +42 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor +You can use the AZs with the physical IDs `usw2-az3` and `usw2-az4`. @@ -46,0 +44 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor +To find the logical AZ names in your account that map to the preceding physical AZ IDs, run the following command. @@ -48,0 +47,5 @@ Before configuring your Oracle Exadata infrastructure, make sure that you perfor + aws ec2 describe-availability-zones \ + --region us-east-1 \ + --query "AvailabilityZones[*].{ZoneName:ZoneName, ZoneId:ZoneId}" \ + --output table + @@ -159 +162 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 2. From the left pane, choose **ODB networks**. + 2. Choose your AWS Region in the upper right. For more information, see Supported Regions for Oracle Database@AWS. @@ -161 +164 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 3. Choose **Create ODB network**. + 3. From the left pane, choose **ODB networks**. @@ -163 +166 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 4. For **ODB network name** , enter a network name. The name must be 1–255 characters and begin with an alphabetic character or underscore. It can't contain consecutive hyphens. + 4. Choose **Create ODB network**. @@ -165 +168 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 5. For **Availability Zone** , choose the AZ name associated with physical ID `use1-az4` or `use1-az6`. + 5. For **ODB network name** , enter a network name. The name must be 1–255 characters and begin with an alphabetic character or underscore. It can't contain consecutive hyphens. @@ -167 +170 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 6. For **Client subnet CIDR** , specify a CIDR range for the client connections. For more information, see Client subnet CIDR requirements for the ODB network. + 6. For **Availability Zone** , choose an AZ name. For supported AZs, see Supported Regions for Oracle Database@AWS. @@ -169 +172 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 7. For **Backup subnet CIDR** , specify a CIDR range for the backup connections. To isolate the backup traffic and improve resiliency, we recommend that you don't overlap the backup CIDR and the client CIDR. For more information, see Backup subnet CIDR requirements for the ODB network. + 7. For **Client subnet CIDR** , specify a CIDR range for the client connections. For more information, see Client subnet CIDR requirements for the ODB network. @@ -171 +174 @@ This task assumes that you have read Planning IP address space in Oracle Databas - 8. (Optional) For **VPC ID** , specify the ID of a VPC to use for ODB peering to the ODB network. When you create an ODB peering connection, application servers running in the specified VPC can access Exadata databases that you create on VM clusters. + 8. For **Backup subnet CIDR** , specify a CIDR range for the backup connections. To isolate the backup traffic and improve resiliency, we recommend that you don't overlap the backup CIDR and the client CIDR. For more information, see Backup subnet CIDR requirements for the ODB network. @@ -173 +176,8 @@ This task assumes that you have read Planning IP address space in Oracle Databas -###### Important + 9. For **DNS configuration** , choose either of the following options: + +**Default** + + +For **Domain name prefix** , enter a name to use as a prefix to your domain. The domain name is fixed as **oraclevcn.com**. For example, if you enter `myhost`, the fully qualified domain name is **myhost.oraclevcn.com**. + +**Custom domain name** @@ -175 +184,0 @@ This task assumes that you have read Planning IP address space in Oracle Databas -After you create your ODB network, update your VPC route tables with the destination CIDR in the ODB network. For more information, see [Configuring VPC route tables for ODB peering](./configuring.html#configure-routes). @@ -177 +186,21 @@ After you create your ODB network, update your VPC route tables with the destina - 9. (Optional) For **Domain name prefix** , enter a name to use as a prefix to your domain. The domain name is fixed as **oraclevcn.com**. For example, if you enter `myhost`, the fully qualified domain name is **myhost.oraclevcn.com.** +For **Domain name** , enter a complete domain name. For example, you might enter **myhost.myodb.com**. + + 10. (Optional) For **Service integrations** , select a service to integrate with your network using VPC Lattice. Oracle Database@AWS integrates with various AWS services to provide enhanced functionality and connectivity options for your Oracle databases. Select either of the following integrations: + +**Amazon S3** + + +Enable direct ODB network access to Amazon S3. Your databases can access S3 for data import/export or custom backups. You can enter a JSON policy + +**Zero-ETL** + + +Enable real-time analytics and machine learning on transactional data using Amazon Redshift. + +###### Note + +In this preview, the **Zero-ETL** option appears in the console, but Zero-ETL integration isn't supported. + +For more information, see [AWS service integrations for Oracle Database@AWS](./service-integrations.html). + +###### Note @@ -179 +208 @@ After you create your ODB network, update your VPC route tables with the destina - 10. (Optional) For **Tags** , enter up to 50 tags for the network. A tag is a key-value pair that you can use to organize and track your resources. +When you create your ODB network, Oracle Database@AWS automatically preconfigures access for Oracle managed automatic backups to Amazon S3. @@ -181 +210 @@ After you create your ODB network, update your VPC route tables with the destina - 11. Choose **Create ODB network**. + 11. (Optional) For **Tags** , enter up to 50 tags for the network. A tag is a key-value pair that you can use to organize and track your resources. @@ -182,0 +212 @@ After you create your ODB network, update your VPC route tables with the destina + 12. Choose **Create ODB network**. @@ -185,0 +216,3 @@ After you create your ODB network, update your VPC route tables with the destina + +After you have created an ODB network, you can peer it to a VPC. _ODB peering_ is a user-created network connection that enables traffic to be routed privately between an Amazon VPC and an ODB network. After peering, an Amazon EC2 instance within the VPC can communicate with resources in the ODB network as if they were within the same network. For more information, see [Configuring ODB peering to an Amazon VPC in Oracle Database@AWS](./configuring.html). + @@ -261 +294,15 @@ Oracle Cloud Infrastructure performs system maintenance during this window. Duri -An Exadata VM cluster is a set of VMs on which you can install Oracle Exadata databases. You create VM clusters on Exadata infrastructure. You can deploy multiple VM clusters with different Oracle Exadata infrastructures in the same ODB network. +An Exadata VM cluster is a set of VMs on which you can create Oracle Exadata databases. You create the VM clusters on Exadata infrastructure. You can deploy multiple VM clusters with different Oracle Exadata infrastructures in the same ODB network. You have full administrative control over the databases that you create on Exadata VM clusters. + +An Autonomous VM cluster is a preallocated pool of Oracle Exadata compute and storage resources, virtualized at the VM level, that runs Autonomous Databases (ADB). Unlike user-managed databases that you create on an Exadata VM cluster, an Autonomous database is self-tuning, self-patching, and managed by Oracle rather than a database administrator. + +Consider the following limitations when you create VM clusters: + + * You can deploy a VM cluster only into the AZ where you created your ODB network and Oracle Exadata infrastructure. + + * If you don't share a VM cluster across accounts, it must be in the same AWS account as the Oracle Exadata infrastructure. If you use AWS RAM to share an ODB network and Oracle Exadata infrastructure from one AWS account with a trusted account, the trusted account can create VM clusters in its own account. + + * You can deploy only VM clusters in your ODB network. No other resources are permitted. + + * You can't change the storage allocation after you create a VM cluster. + + @@ -263 +309,0 @@ An Exadata VM cluster is a set of VMs on which you can install Oracle Exadata da -You can also create an Autonomous database to deploy on your Exadata infrastructure. @@ -389 +435,14 @@ Select **Enable mutual TLS (mTLS) authentication** to allow mutual TLS authentic -You create and manage ODB networks, Oracle Exadata infrastructure, and Exadata VM clusters in Oracle Database@AWS. You create and manage Oracle Exadata databases in Oracle Cloud Infrastructure. +In Oracle Database@AWS, you can create and manage the following resources using the AWS console, CLI, or APIs: + + * ODB networks + + * Oracle Exadata infrastructure + + * Exadata VM clusters and Autonomous VM clusters + + * ODB peering connections + + + + +To create and manage Oracle Exadata databases on the infrastructure that you created, you must use the Oracle Cloud Infrastructure console rather than the Oracle Database@AWS dashboard. You can create a user-managed Exadata database on an Exadata VM cluster and an Autonomous Database on an Autonomous Exadata VM cluster. For information about creating Oracle databases in OCI, see [Exadata Database](https://docs.oracle.com/en-us/iaas/Content/database-at-aws-exadata-awscr/awscr-create-exadata-database.html) in the Oracle Cloud Infrastructure documentation. @@ -395 +454 @@ You create and manage ODB networks, Oracle Exadata infrastructure, and Exadata V - 2. From the left pane, choose **Exadata VM clusters**. + 2. From the left pane, choose **Exadata VM clusters** or **Autonomous VM clusters**. @@ -397 +456 @@ You create and manage ODB networks, Oracle Exadata infrastructure, and Exadata V - 3. Choose an Exadata VM cluster to see the details page. + 3. Choose a VM cluster to see the details page. @@ -401,5 +460 @@ You create and manage ODB networks, Oracle Exadata infrastructure, and Exadata V -###### Note - -In this preview, the **Manage in OCI** button is supported only in the Exadata VM cluster details page, not in the Exadata VM clusters list page. - - 5. Create your Exadata databases in OCI. + 5. Create your user-managed Exadata database or Autonomous Database in OCI. @@ -418 +473 @@ Onboarding -Configuring the network +ODB peering