Connection Auth

{
  "username": "dbadmin",
  "password": "your-password",
  "engine": "oracle",
  "host": "mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com",
  "port": 1521,
  "dbname": "ORCL"
}

aws secretsmanager create-secret \
  --name oracle/myapp/db-creds \
  --secret-string file://db-creds.json

import json, boto3, oracledb

def get_connection(secret_name: str, region: str = "us-east-1") -> oracledb.Connection:
    client = boto3.client("secretsmanager", region_name=region)
    secret = json.loads(client.get_secret_value(SecretId=secret_name)["SecretString"])
    dsn = f'{secret["host"]}:{secret["port"]}/{secret["dbname"]}'
    return oracledb.connect(user=secret["username"], password=secret["password"], dsn=dsn)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["secretsmanager:GetSecretValue"],
      "Resource": "arn:aws:secretsmanager:<region>:<account>:secret:<secret-name>*"
    },
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:<region>:<account>:key/<key-id>",
      "Condition": { "StringEquals": { "kms:ViaService": "secretsmanager.<region>.amazonaws.com" } }
    }
  ]
}

aws iam create-role \
  --role-name rds-directoryservice-kerberos-access-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect":"Allow","Principal":{"Service":"rds.amazonaws.com"},"Action":"sts:AssumeRole"}]
  }'

aws iam attach-role-policy \
  --role-name rds-directoryservice-kerberos-access-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonRDSDirectoryServiceAccess

# New instance
aws rds create-db-instance \
  --db-instance-identifier my-oracle-kerberos \
  --db-instance-class db.r5.large \
  --engine oracle-ee \
  --license-model bring-your-own-license \
  --master-username admin --master-user-password <pw> \
  --allocated-storage 100 \
  --db-subnet-group-name my-db-subnet-group \
  --vpc-security-group-ids sg-xxxxxxxx \
  --port 1521 \
  --storage-encrypted --kms-key-id <kms-key-arn> \
  --domain d-xxxxxxxxxx \
  --domain-iam-role-name rds-directoryservice-kerberos-access-role

# Or modify existing
aws rds modify-db-instance \
  --db-instance-identifier my-oracle-instance \
  --domain d-xxxxxxxxxx \
  --domain-iam-role-name rds-directoryservice-kerberos-access-role \
  --apply-immediately

aws rds describe-db-instances \
  --db-instance-identifier my-oracle-kerberos \
  --query 'DBInstances[*].DomainMemberships' --output table

-- For an on-prem AD user joedoe@onprem.local
CREATE USER "JOEDOE@ONPREM.LOCAL" IDENTIFIED EXTERNALLY;
GRANT CREATE SESSION TO "JOEDOE@ONPREM.LOCAL";

-- For an AWS Managed AD user
CREATE USER "JOEDOE@AD.MYAWS.COM" IDENTIFIED EXTERNALLY;
GRANT CREATE SESSION TO "JOEDOE@AD.MYAWS.COM";

[libdefaults]
  default_realm = ONPREM.LOCAL
  default_ccache_name = /tmp/kerbcache

[realms]
  AD.MYAWS.COM = { kdc = ad.myaws.com; admin_server = ad.myaws.com }
  ONPREM.LOCAL = { kdc = onprem.local; admin_server = onprem.local }

[domain_realm]
  .ad.myaws.com = AD.MYAWS.COM
  .onprem.local = ONPREM.LOCAL

SQLNET.AUTHENTICATION_SERVICES = (KERBEROS5PRE,KERBEROS5)
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.KERBEROS5_CONF_MIT = TRUE
SQLNET.KERBEROS5_CC_NAME = /tmp/kerbcache
SQLNET.FALLBACK_AUTHENTICATION = TRUE

# Generate ticket (Linux)
okinit joedoe@ONPREM.LOCAL

# sqlplus — no password
sqlplus /@mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com:1521/ORCL

# SQL Developer: Authentication Type = Kerberos, no password, hostname/port/service as usual