AWS odb documentation change
Summary
Expanded documentation about ODB network configurations, added support for US West (Oregon) region, clarified peering mechanics with AWS Transit Gateway/Cloud WAN, and updated resource creation methods to include CLI/APIs
Security assessment
Changes focus on network architecture expansions and multi-region support rather than addressing security vulnerabilities. While CIDR validation and cross-account peering via AWS RAM are mentioned, these are standard networking practices without evidence of addressing specific security flaws.
Diff
diff --git a/odb/latest/UserGuide/how-it-works.md b/odb/latest/UserGuide/how-it-works.md index 592f6dabe..c9e59ac0d 100644 --- a//odb/latest/UserGuide/how-it-works.md +++ b//odb/latest/UserGuide/how-it-works.md @@ -5 +5 @@ -OCI child sitesOracle Exadata infrastructureODB networkVirtual Private Cloud (VPC)ODB peeringExadata VM clustersAutonomous VM clustersOracle Exadata databases +OCI child sitesOracle Exadata infrastructureODB networkVirtual Private Cloud (VPC)ODB peeringRouting traffic from multiple VPCsExadata VM clustersAutonomous VM clustersOracle Exadata databases @@ -13 +13,3 @@ Oracle Database@AWS integrates Oracle Cloud Infrastructure (OCI) with the AWS Cl -Oracle Exadata Database Service on Dedicated Infrastructure is an OCI service that provides Exadata Database Machine. Oracle Exadata Database Machine is an integrated, preconfigured, and pretested full-stack platform for use in enterprise data centers. You create the Oracle Exadata infrastructure in an AWS Availability Zone (AZ) using the AWS console. Then you use OCI APIs to create and manage the Oracle Exadata databases. These Exadata databases are accessible to Amazon EC2 application servers running in an Amazon VPC. +Oracle Exadata Database Service on Dedicated Infrastructure is an OCI service that provides Exadata Database Machine. Oracle Exadata Database Machine is an integrated, preconfigured, and pretested full-stack platform for use in enterprise data centers. You can create the Oracle Exadata infrastructure and VM clusters in an AWS Availability Zone (AZ) using the AWS console, CLI, or APIs. + +After you have created your resources in AWS, you use OCI APIs to create and manage Oracle Exadata databases. An ODB network, which you peer to an Amazon VPC, enables Amazon EC2 application servers to access your Exadata databases. In this way, Oracle Exadata databases are integrated into the AWS environment. @@ -25 +27 @@ Oracle Cloud Infrastructure is hosted in OCI regions and availability domains. A -The OCI child site for Oracle Database@AWS physically resides in an AWS data center. AWS hosts the Exadata infrastructure, and OCI provisions and maintains the Exadata infrastructure hardware inside the data center. You configure the Exadata infrastructure, private network, and VM clusters using the AWS console. Because the infrastructure exists within the AWS Cloud, you can use services such as Amazon EC2 and Amazon VPC to allow application access. +The OCI child site for Oracle Database@AWS physically resides in an AWS data center. AWS hosts the Exadata infrastructure, and OCI provisions and maintains the Exadata infrastructure hardware inside the data center. You can configure the Exadata infrastructure, private network, and VM clusters using the AWS console, CLI, or APIs. You can use AWS services such as Amazon EC2 and Amazon VPC to allow application access to Oracle Exadata databases running on the infrastructure. @@ -29 +31 @@ The OCI child site for Oracle Database@AWS physically resides in an AWS data cen -The Oracle Exadata infrastructure is the underlying architecture of database servers, storage servers, and networking that runs Oracle Exadata databases. You create VM clusters on Exadata infrastructure using AWS APIs. +The Oracle Exadata infrastructure is the underlying architecture of database servers and storage servers that runs Oracle Exadata databases. The infrastructure resides in an AWS Availability Zone (AZ). To create VM clusters on Exadata infrastructure, you use the AWS console, CLI, or APIs. @@ -31 +33 @@ The Oracle Exadata infrastructure is the underlying architecture of database ser -The Oracle Exadata infrastructure is distributed on physical machines called database servers. These servers provide the compute resources, analogous to Amazon EC2 dedicated servers. Each database server hosts one or more virtual machines (VMs) running on a hypervisor. For architectural diagrams, see [Exadata Database Service on Dedicated Infrastructure Technical Architecture](https://docs.oracle.com/en/engineered-systems/exadata-cloud-service/ecsid/exadbd_overview.html). +The Oracle Exadata infrastructure is distributed on physical machines called _database servers_. These servers provide the compute resources, similar to Amazon EC2 dedicated servers. Each database server hosts one or more virtual machines (VMs) running on a hypervisor. For architectural diagrams that illustrate these relationships, see [Exadata Database Service on Dedicated Infrastructure Technical Architecture](https://docs.oracle.com/en/engineered-systems/exadata-cloud-service/ecsid/exadbd_overview.html). @@ -33 +35 @@ The Oracle Exadata infrastructure is distributed on physical machines called dat -When you create Exadata infrastructure, you specify information such as the following: +When you create Exadata infrastructure in Oracle Database@AWS, you specify information such as the following: @@ -39,5 +41 @@ When you create Exadata infrastructure, you specify information such as the foll - * The Availability Zone (AZ) that hosts the infrastructure - -###### Note - -You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). The only supported physical AZs within this Region have the physical IDs `use1-az4` and `use1-az6`. To find the logical zone names in your account that map to the physical zone IDs, run the following command. + * The Exadata system model (X11M) @@ -45,4 +43 @@ You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). - aws ec2 describe-availability-zones --region us-east-1 --query "AvailabilityZones[*].{ZoneName:ZoneName, ZoneId:ZoneId}" - - - * The Exadata system model, either X9M or X11M + * The AZ that hosts the infrastructure (see [Supported Regions for Oracle Database@AWS](./getting-started.html#supported-odb-regions)) @@ -57 +52 @@ To learn how to create Oracle Exadata infrastructure, see [Step 2: Create an Ora -An _ODB network_ is a private isolated network that hosts OCI infrastructure in an AWS Availability Zone (AZ). The ODB network consists of a CIDR range of IP addresses. The ODB network maps directly to the network that exists within the OCI child site, thus serving as the means of communication between AWS and OCI. You specify an ODB network when you create your Exadata VM clusters. +An _ODB network_ is a private isolated network that hosts OCI infrastructure in an AWS Availability Zone (AZ). The ODB network consists of a CIDR range of IP addresses. The ODB network maps directly to the network that exists within the OCI child site, thus serving as the means of communication between AWS and OCI. You must specify an ODB network when you create your Exadata VM clusters (see [Step 3: Create an Exadata VM cluster or Autonomous VM cluster in Oracle Database@AWS](./getting-started.html#getting-started-vm)). @@ -78 +73,4 @@ When you create an ODB network, you specify information such as the following: -You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). The only supported physical AZs within this Region have the physical IDs `use1-az4` and `use1-az6`. To find the logical zone names in your account that map to the physical zone IDs, run the following command. +You can use Oracle Database@AWS in the following AWS Regions: + +**US East (N. Virginia)** + @@ -80 +78 @@ You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). - aws ec2 describe-availability-zones --region us-east-1 --query "AvailabilityZones[*].{ZoneName:ZoneName, ZoneId:ZoneId}" +You can use the AZs with the physical IDs `use1-az4` and `use1-az6`. @@ -81,0 +80 @@ You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). +**US West (Oregon)** @@ -83 +81,0 @@ You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). - * Client CIDR addresses — The ODB network requires a client subnet CIDR for Exadata VM clusters. @@ -85 +83,14 @@ You can only deploy Oracle Database@AWS in the AWS Region US East (N. Virginia). - * Backup CIDR addresses — The ODB network requires a backup subnet CIDR for managed database backups. +You can use the AZs with the physical IDs `usw2-az3` and `usw2-az4`. + +To find the logical AZ names in your account that map to the preceding physical AZ IDs, run the following command. + + aws ec2 describe-availability-zones \ + --region us-east-1 \ + --query "AvailabilityZones[*].{ZoneName:ZoneName, ZoneId:ZoneId}" \ + --output table + + * Client CIDR addresses — The ODB network requires a client subnet CIDR for Exadata VM clusters and Autonomous VM clusters. + + * Backup CIDR addresses — The ODB network requires a backup subnet CIDR for managed database backups of VM clusters. The backup subnet is optional for Exadata VM clusters. + + * AWS service integrations — You can configure a network path from your ODB network to Amazon S3. For more information, see [AWS service integrations for Oracle Database@AWS](./service-integrations.html). @@ -102 +113 @@ By default, the ODB network doesn't have connectivity to VPCs. To connect the OD -_ODB peering_ between an ODB network and a VPC enables traffic to be routed privately between one VPC and one ODB network. Because the ODB network is private, by default it does not have connectivity to VPCs, on-premise networks, or the internet. To connect to Exadata databases in the ODB network, set up an ODB peering connection. +_ODB peering_ is a user-created network connection that enables traffic to be routed privately between an Amazon VPC and an ODB network. There is a 1:1 relationship between a VPC and an ODB network. After peering, an Amazon EC2 instance within the VPC can communicate with an Oracle Exadata database in the ODB network as if they were within the same network. @@ -106 +117 @@ _ODB peering_ between an ODB network and a VPC enables traffic to be routed priv -ODB peering is different from VPC peering, which is a peering connection between two VPCs that enables you to route traffic between them. +ODB peering is different from VPC peering, which is a peering connection between two VPCs that routes traffic between them. @@ -110 +121,5 @@ ODB peering is different from VPC peering, which is a peering connection between -To set up ODB peering between an ODB network and one VPC, specify the VPC when you create or update the ODB network. Then update your VPC route tables using the Amazon EC2 command `create-route`. The ODB network route tables are automatically updated with the VPC CIDR addresses. After peering, an Amazon EC2 instance within the VPC can communicate with an Oracle Exadata database in the ODB network as if they were within the same network. For more information, see [Step 1: Create an ODB network in Oracle Database@AWS](./getting-started.html#getting-started-odb) and [Updating an ODB network in Oracle Database@AWS](./managing.html#managing.updating). +You can peer an ODB network in one account and a VPC in another account using AWS RAM. If you share an ODB network with another account, the trust account can directly initiate peering. The account that initiates the ODB peering connection owns and manages the connection. For more information, see . + +### Creation of an ODB peering connection + +An ODB peering connection isn't a characteristic of an ODB network but is an independent resource with its own ID (prefixed with `odbpcx-`) and lifecycle. You manage a peering connection with a set of dedicated APIs. For example, you create an ODB peering connection to an existing ODB network using the Oracle Database@AWS console or the `CreateOdbPeeringConnection` API. For more information, see [Creating an ODB peering connection in Oracle Database@AWS](./configuring.html#network-peering). @@ -112 +127,20 @@ To set up ODB peering between an ODB network and one VPC, specify the VPC when y -Amazon VPC Transit Gateways is a network transit hub used to interconnect VPCs and on-premises networks. You can't create a one-to-many peering connection between an ODB network and multiple VPCs. But you can peer your ODB network to a VPC, and then attach this VPC to a transit gateway. The gateway can connect to multiple VPCs. With this configuration, you can route traffic between multiple VPC subnets to your ODB network. +When you create an ODB peering connection, Oracle Database@AWS performs the following actions automatically: + + 1. Validates the network configurations, including checking for overlapping CIDR blocks + + 2. Sets up the underlying network peering infrastructure + + 3. Configures the ODB network (not the VPC) route tables with the VPC CIDR addresses + + + + +After you create your ODB peering connection, update your VPC route tables manually using the Amazon EC2 `create-route` command. For more information, see [Configuring VPC route tables for ODB peering](./configuring.html#configure-routes). + +## Routing traffic from multiple VPCs + +To allow multiple VPCs to access Oracle Database@AWS resources in one ODB network, you can use AWS Transit Gateway or AWS Cloud WAN. + +### AWS Transit Gateway + +An Amazon VPC transit gateway is a network transit hub used to interconnect VPCs and on-premises networks. You can't create a one-to-many peering connection between an ODB network and multiple VPCs. But you can peer your ODB network to a VPC, and then attach this VPC to a transit gateway. The gateway can connect to multiple VPCs. With this configuration, you can route traffic between multiple VPC subnets to your ODB network. @@ -115,0 +150,8 @@ Amazon VPC Transit Gateways is a network transit hub used to interconnect VPCs a +For more information, see [Configuring Amazon VPC Transit Gateways for Oracle Database@AWS](./configuring.html#configuring-tgw). + +### AWS Cloud WAN + +AWS Cloud WAN is a managed wide-area networking (WAN) service that enables you to build, manage, and monitor a unified global network connecting resources across your cloud and on-premises environments. Using the central dashboard, you can connect on-premises branch offices, data centers, and VPCs across the AWS global network. + +You can peer your ODB network to a VPC, and then attach this VPC to the Cloud WAN core network. With this configuration, you can use Cloud WAN to route traffic between multiple VPCs or on-premises networks and your ODB network. For more information, see [Configuring AWS Cloud WAN for Oracle Database@AWS](./configuring.html#configuring-cwan). + @@ -139 +181 @@ _Autonomous VM clusters_ are fully managed databases that automate key managemen -You can configure the ECPU core count per VM, database memory per CPU, database storage, and maximum number of autonomous container database. For more information, see [Step 3: Create an Exadata VM cluster or Autonomous VM cluster in Oracle Database@AWS](./getting-started.html#getting-started-vm). +You can configure the ECPU core count per VM, database memory per CPU, database storage, and maximum number of autonomous container databases. For more information, see [Step 3: Create an Exadata VM cluster or Autonomous VM cluster in Oracle Database@AWS](./getting-started.html#getting-started-vm).