Autonomous AI Databases Encrypted with Customer-Managed Keys

Sign in to your Oracle Cloud Infrastructure (OCI) account.

Navigate to Autonomous AI Databases console available at https://cloud.oracle.com/db/adbs.

For Applied filters, choose an OCI compartment from the Compartment dropdown menu, to list the Autonomous AI Databases provisioned in the selected compartment.

Click on the name (link) of the Autonomous AI Database that you want to examine, listed in the Display Name column.

Select the Autonomous AI Database information tab, and check the Encryption key attribute value, listed in the Encryption section. If Encryption key is set to Oracle-managed key, encryption at rest using Customer-Managed Keys (CMKs) is not enabled for the selected Oracle Cloud Infrastructure (OCI) Autonomous AI Database.

Run iam compartment list command (Windows/macOS/Linux) with output query filters to list the ID of each compartment available in your Oracle Cloud Infrastructure (OCI) account:

oci iam compartment list
	--all
	--include-root
	--query 'data[]."id"'

The command output should return the requested OCI compartment identifiers (OCIDs):

[
	"ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
	"ocid1.compartment.oc1..abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd"
]

Run db autonomous-database list command (Windows/macOS/Linux) with the ID of the OCI compartment that you want to examine as the identifier parameter, to list the ID of each Autonomous AI Database provisioned in the selected OCI compartment:

oci db autonomous-database list
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--all
	--query 'data[]."id"'

The command output should return the requested database instance IDs:

[
	"ocid1.autonomousdatabase.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
	"ocid1.autonomousdatabase.oc1.ap-sydney-1.abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd"
]

Run db autonomous-database get command (Windows/macOS/Linux) with the name of the Autonomous AI Database that you want to examine as the identifier parameter and custom output filters to determine if encryption at rest using Customer-Managed Keys (CMKs) is enabled for the selected database instance:

oci db autonomous-database get
	--autonomous-database-id 'ocid1.autonomousdatabase.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--query='data."kms-key-id"'

The command output should return the ID of the Customer-Managed Key (CMK) configured for the selected database instance:

"ORACLE_MANAGED_KEY"

If the db autonomous-database get command output returns "ORACLE_MANAGED_KEY" instead of the CMK ID, as shown in the output example above, encryption at rest using Customer-Managed Keys (CMKs) is not enabled for the selected Oracle Cloud Infrastructure (OCI) Autonomous AI Database.

Sign in to your Oracle Cloud Infrastructure (OCI) account.

Navigate to Vaults console available at https://cloud.oracle.com/security/kms.

For Applied filters, choose the OCI compartment that you want to access from the Compartment dropdown menu.

Choose Create Vault and perform the following actions to create the OCI Vault that will store your new Customer-Managed Key (CMK):

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Name, enter a unique name for the new Vault.
3. (Optional) Check the Make it a virtual private vault setting checkbox if you want a dedicated partition in a Hardware Security Module (HSM).
4. (Optional) Choose Tags, select Add tag, and use the Key and Value fields to improve resource management by adding resource tags.
5. Choose Create Vault to deploy your new OCI Vault.

Once the Vault deployment is complete, click on the name (link) of the new OCI Vault instance, listed in the Name column.

Select the Master encryption keys tab, choose Create Key, and perform the following actions to create the Customer-Managed Key (CMK) required for database instance encryption:

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Protection Mode, choose the suitable protection mode for your key. The protection mode indicates how the key persists and where cryptographic operations that use the key are performed. Choose HSM to store and process the key on a Hardware Security Module (recommended for use cases with stringent compliance requirements) or Software to store and process the key on a server (recommended for most use cases). For more details about key protection modes, see the OCI official documentation.
3. For Name, enter a unique name for the new encryption key.
4. For Key Shape: Algorithm and Key Shape: Length, choose AES (Symmetric key used for Encrypt and Decrypt) with 256 bits.
5. (Optional) Choose Tags, select Add tag, and use the Key and Value fields to add tags in order to organize your resource.
6. Choose Create Key to generate your new Customer-Managed Key (CMK).

Once your new KMS key is available, navigate to Autonomous AI Databases console available at https://cloud.oracle.com/db/adbs.

For Applied filters, choose an OCI compartment from the Compartment dropdown menu, to list the Autonomous AI Databases provisioned in the selected compartment.

Click on the name (link) of the Autonomous AI Database that you want to configure, listed in the Display Name column.

Select More actions from the page top menu, choose Manage encryption key, and perform the following actions to select the key:

1. Choose Encrypt using a customer-managed key.
2. For Key type, select Oracle.
3. For Key location, select This tenancy.
4. For Vault, select the name of the OCI Vault created in step no. 4.
5. For Master encryption key, select the name of the Customer-Managed Key created in step no. 6.
6. Choose Save to associate the Customer-Managed Key (CMK) key with the selected OCI Autonomous AI Database.

Run kms management vault create command (Windows/macOS/Linux) to create the OCI Vault that will store your new KMS Customer-Managed Key (CMK):

oci kms management vault create
	--display-name 'cc-project5-oci-vault'
	--vault-type 'DEFAULT'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

The command output should return the configuration information available for the new OCI Vault:

{
	"data": {
		"compartment-id": "ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
		"crypto-endpoint": null,
		"defined-tags": {},
		"display-name": "cc-project5-oci-vault",
		"external-key-manager-metadata-summary": null,
		"freeform-tags": {},
		"id": "ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234",
		"is-primary": true,
		"is-vault-replicable": null,
		"lifecycle-state": "CREATING",
		"management-endpoint": null,
		"replica-details": null,
		"restored-from-vault-id": null,
		"time-of-deletion": null,
		"vault-type": "DEFAULT",
		"wrappingkey-id": ""
	},
	"etag": "abcd1234abcd1234abcd1234abcd1234abcd1234"
}

Run kms management vault get command (Windows/macOS/Linux) to describe the management endpoint configured for the OCI Vault created in the previous steps:

oci kms management vault get
	--vault-id 'ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
	--query 'data."management-endpoint"'

The command output should return the URL of the management endpoint configured for the selected Vault:

"https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com"

Run kms management key create command (Windows/macOS/Linux) to create a new KMS Customer-Managed Key (CMK) for your OCI Vault. For --key-shape parameter, specify the key shape algorithm and length. For --protection-mode parameter, specify the suitable protection mode for your key. For the --endpoint parameter, specify the OCI Vault management endpoint returned in the previous step:

oci kms management key create
	--display-name 'cc-project5-kms-key'
	--key-shape '{"algorithm":"AES","length":32}'
	--protection-mode 'SOFTWARE'
	--endpoint 'https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--query 'data."id"'

The command output should return the configuration information available for the new KMS key:

"ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd"

Run db autonomous-database configure-key command (Windows/macOS/Linux) with the name of the Autonomous AI Database that you want to configure as the identifier parameter, to enable encryption at rest with OCI KMS Customer-Managed Keys (CMKs) for the selected database instance. For --vault-id, provide the resource ID of your OCI Vault, returned in step no. 2. For the --kms-key-id parameter, specify the ID of your Customer-Managed Key, returned in the previous step:

oci db autonomous-database configure-key
	--autonomous-database-id 'ocid1.autonomousdatabase.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--vault-id 'ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
	--kms-key-id 'ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

The command output should return the command request ID and eTag:

{
	"etag": "abcd1234",
	"opc-work-request-id": "ocid1.coreservicesworkrequest.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd"
}