AWS transform documentation change
Summary
Added Oracle Database discovery documentation including OS-level fallback detection requirements, SQL connection permissions, and updated quick reference table
Security assessment
Added documentation for Oracle Database permissions including requirement for passwordless sudo access and read-only SQL role (SELECT_CATALOG_ROLE). Promotes least privilege access but no security vulnerability is addressed.
Diff
diff --git a/transform/latest/userguide/discovery-tool-permissions.md b/transform/latest/userguide/discovery-tool-permissions.md index 457bc35fa..24893ecfa 100644 --- a//transform/latest/userguide/discovery-tool-permissions.md +++ b//transform/latest/userguide/discovery-tool-permissions.md @@ -7 +7 @@ -VMware vCenterHyper-V hosts (Windows)Linux servers (SSH)Windows servers (WinRM) — OS metricsWindows servers (WinRM) — Database collection (SQL Server)Network collectionQuick reference: Minimum permissions by use case +VMware vCenterHyper-V hosts (Windows)Linux servers (SSH)Windows servers (WinRM) — OS metricsWindows servers (WinRM) — SQL Server collectionOracle Database (SQL)Network collectionQuick reference: Minimum permissions by use case @@ -59,0 +60 @@ Network connections with process name and PID | Yes | Connections are still coll +Oracle Database OS-level detection (fallback when Oracle credentials are not configured) | Yes | Basic Oracle presence detection (oratab, process monitor) works without sudo. Detailed collection (opatch, lsnrctl, ASM, Grid Infrastructure) requires passwordless `sudo -u oracle` access to the Oracle home binaries. @@ -86 +87,5 @@ Local Administrator membership implicitly grants Performance Monitor Users acces -## Windows servers (WinRM) — Database collection (SQL Server) +###### Note + +Oracle Database OS-level fallback detection on Windows uses registry queries and `Get-Service` and `Get-Process` commands when Oracle credentials are not configured. These commands require only standard Remote Management Users access. No additional permissions beyond OS metrics requirements are needed. + +## Windows servers (WinRM) — SQL Server collection @@ -88 +93 @@ Local Administrator membership implicitly grants Performance Monitor Users acces -Database collection discovers SQL Server instances, Reporting Services (SSRS), and Integration Services (SSIS) on Windows servers. +SQL Server collection discovers SQL Server instances, Reporting Services (SSRS), and Integration Services (SSIS) on Windows servers. @@ -92 +97 @@ Database collection discovers SQL Server instances, Reporting Services (SSRS), a -Local Administrator is recommended because database discovery queries multiple WMI namespaces and requires elevated access for some operations: +Local Administrator is recommended because SQL Server discovery queries multiple WMI namespaces and requires elevated access for some operations: @@ -100 +105 @@ SQL Server Integration Services (SSIS) | Registry read access (HKLM) | SSIS vers -Port-to-service association | Access to TCP listener enumeration | Cannot associate listening ports with database services +Port-to-service association | Access to TCP listener enumeration | Cannot associate listening ports with SQL Server services @@ -104 +109,18 @@ Port-to-service association | Access to TCP listener enumeration | Cannot associ -Database collection is Windows-only. The discovery tool skips Linux servers for database discovery. +SQL Server collection is Windows-only. The discovery tool skips Linux servers for SQL Server discovery. + +## Oracle Database (SQL) + +Oracle Database collection connects directly to Oracle instances on port 1521 (or a custom port) to collect database metadata. The discovery tool does not require DBA or SYSDBA privileges. + +**Minimum required access:** A read-only Oracle service account with the SELECT_CATALOG_ROLE grant. + +The discovery tool does not access Diagnostics Pack or Tuning Pack views, so no additional Oracle license is required for data collection. + +**SQL to create the account:** + + + CREATE USER discovery_user IDENTIFIED BY <password>; + GRANT CREATE SESSION TO discovery_user; + GRANT SELECT_CATALOG_ROLE TO discovery_user; + +**OS-level fallback:** If database credentials are not configured or the connection fails, the discovery tool uses existing SSH or WinRM OS credentials to detect Oracle installations. No additional Oracle-specific OS permissions are needed beyond what the OS metrics module requires. @@ -127,0 +150 @@ SQL Server database discovery | WinRM user | Local Administrator +Oracle database discovery (SQL) | Oracle service account | SELECT_CATALOG_ROLE (read-only, no DBA or SYSDBA)