Compute Runtime

# Install client (thin mode preferred — no Oracle Client needed)
pip install oracledb      # Python
npm install oracledb      # Node.js

bash scripts/test_connectivity.sh <rds-endpoint> 1521
python3 scripts/test_oracle_connection.py <endpoint> 1521 ORCL dbadmin

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["secretsmanager:GetSecretValue", "kms:Decrypt"],
    "Resource": [
      "arn:aws:secretsmanager:<region>:<account>:secret:oracle-creds-*",
      "arn:aws:kms:<region>:<account>:key/<key-id>"
    ]
  }]
}

{
  "containerDefinitions": [{
    "name": "app",
    "image": "<repo>/app:1.0",
    "secrets": [
      {
        "name": "DB_USERNAME",
        "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:oracle-creds-abc:username::"
      },
      {
        "name": "DB_PASSWORD",
        "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:oracle-creds-abc:password::"
      }
    ],
    "environment": [
      { "name": "DB_HOST", "value": "mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com" },
      { "name": "DB_PORT", "value": "1521" },
      { "name": "DB_SERVICE", "value": "ORCL" }
    ]
  }],
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecs-task-execution-role",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecs-app-role"
}

# CSI driver
helm repo add secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
helm install -n kube-system csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver

# AWS provider
kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/deployment/aws-provider-installer.yaml

# Ensure OIDC provider is associated
eksctl utils associate-iam-oidc-provider --cluster <cluster-name> --approve

# Create service account with IAM role
eksctl create iamserviceaccount \
  --cluster <cluster-name> \
  --namespace default \
  --name oracle-app-sa \
  --attach-policy-arn arn:aws:iam::<account>:policy/OracleSecretsRead \
  --approve

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["secretsmanager:GetSecretValue", "kms:Decrypt"],
    "Resource": [
      "arn:aws:secretsmanager:<region>:<account>:secret:oracle-creds-*",
      "arn:aws:kms:<region>:<account>:key/<key-id>"
    ]
  }]
}

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: oracle-creds
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "oracle-creds-abc"
        objectType: "secretsmanager"
        jmesPath:
          - path: "username"
            objectAlias: "db-username"
          - path: "password"
            objectAlias: "db-password"
          - path: "host"
            objectAlias: "db-host"
  secretObjects:
  - secretName: oracle-creds-k8s
    type: Opaque
    data:
    - objectName: db-username
      key: db-username
    - objectName: db-password
      key: db-password

apiVersion: apps/v1
kind: Deployment
metadata:
  name: oracle-app
spec:
  replicas: 3
  selector:
    matchLabels: { app: oracle-app }
  template:
    metadata:
      labels: { app: oracle-app }
    spec:
      serviceAccountName: oracle-app-sa
      containers:
      - name: app
        image: <repo>/oracle-app:1.0
        env:
        - name: DB_USERNAME
          valueFrom: { secretKeyRef: { name: oracle-creds-k8s, key: db-username } }
        - name: DB_PASSWORD
          valueFrom: { secretKeyRef: { name: oracle-creds-k8s, key: db-password } }
        volumeMounts:
        - name: secrets
          mountPath: /mnt/secrets
          readOnly: true
      volumes:
      - name: secrets
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: oracle-creds

aws lambda update-function-configuration \
  --function-name oracle-reader \
  --vpc-config SubnetIds=subnet-aaa,subnet-bbb,SecurityGroupIds=sg-lambda-oracle \
  --region us-east-1

mkdir -p python
pip install -t python/ oracledb
zip -r oracledb-layer.zip python/

aws lambda publish-layer-version \
  --layer-name oracledb \
  --zip-file fileb://oracledb-layer.zip \
  --compatible-runtimes python3.11 python3.12

aws lambda update-function-configuration \
  --function-name oracle-reader \
  --layers arn:aws:lambda:us-east-1:<account>:layer:oracledb:1

import json, os, boto3, oracledb

_secret = json.loads(
    boto3.client("secretsmanager").get_secret_value(
        SecretId=os.environ["SECRET_NAME"]
    )["SecretString"]
)
_pool = oracledb.create_pool(
    user=_secret["username"],
    password=_secret["password"],
    dsn=f'{_secret["host"]}:{_secret["port"]}/{_secret["dbname"]}',
    min=1, max=2,
)

def handler(event, context):
    with _pool.acquire() as conn:
        cur = conn.cursor()
        cur.execute("SELECT sysdate FROM dual")
        return {"result": str(cur.fetchone())}