Encryption

resource "aws_db_option_group" "oracle_nne" {
  name                 = "oracle-nne"
  engine_name          = "oracle-ee"
  major_engine_version = "19"

  option {
    option_name = "NATIVE_NETWORK_ENCRYPTION"
    option_settings {
      name  = "SQLNET.ENCRYPTION_SERVER"
      value = "REQUIRED"
    }
    option_settings {
      name  = "SQLNET.ENCRYPTION_TYPES_SERVER"
      value = "AES256"
    }
    option_settings {
      name  = "SQLNET.CRYPTO_CHECKSUM_SERVER"
      value = "REQUIRED"
    }
    option_settings {
      name  = "SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER"
      value = "SHA256"
    }
  }
}

resource "aws_db_option_group" "oracle_tls" {
  name                 = "oracle-tls"
  engine_name          = "oracle-ee"
  major_engine_version = "19"

  option {
    option_name = "SSL"
    port        = 2484

    option_settings {
      name  = "SQLNET.SSL_VERSION"
      value = "1.2"
    }
  }
}

# Global (all RDS regions)
curl -o global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

# Region-specific
curl -o rds-ca-bundle.pem https://truststore.pki.rds.amazonaws.com/<region>/<region>-bundle.pem

import oracledb

conn = oracledb.connect(
    user="dbadmin",
    password="<from-secrets-manager>",
    dsn="tcps://mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com:2484/ORCL",
    ssl_server_dn_match=True,
    wallet_location="/path/to/certs-dir",   # directory containing global-bundle.pem
)

conn = oracledb.connect(
    user="dbadmin", password="<from-secrets-manager>",
    dsn="(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=<endpoint>)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=ORCL))(SECURITY=(SSL_SERVER_DN_MATCH=ON)))",
    wallet_location="/path/to/wallet",      # directory with ewallet.p12, cwallet.sso
)

System.setProperty("javax.net.ssl.trustStore", "/path/to/truststore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

String url = "jdbc:oracle:thin:@(DESCRIPTION="
           + "(ADDRESS=(PROTOCOL=TCPS)(HOST=mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com)(PORT=2484))"
           + "(CONNECT_DATA=(SERVICE_NAME=ORCL))"
           + "(SECURITY=(SSL_SERVER_DN_MATCH=ON)))";

Connection conn = DriverManager.getConnection(url, "dbadmin", "secret");

csplit -z -f /tmp/rds-cert- -b '%02d.pem' global-bundle.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
for f in /tmp/rds-cert-*.pem; do
  keytool -importcert -alias "rds-$(basename "$f" .pem)" \
    -file "$f" -keystore truststore.jks -storepass changeit -noprompt
done
rm -f /tmp/rds-cert-*.pem

export NODE_EXTRA_CA_CERTS=/path/to/global-bundle.pem

const conn = await oracledb.getConnection({
  user: 'dbadmin',
  password: '<from-secrets-manager>',
  connectString: `(DESCRIPTION=
    (ADDRESS=(PROTOCOL=TCPS)(HOST=mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com)(PORT=2484))
    (CONNECT_DATA=(SERVICE_NAME=ORCL))
    (SECURITY=(SSL_SERVER_DN_MATCH=YES)))`,
  sslServerCertDN: 'CN=mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com'
});

var connString = "User Id=dbadmin;Password=<from-secrets-manager>;"
  + "Data Source=(DESCRIPTION="
      + "(ADDRESS=(PROTOCOL=TCPS)(HOST=mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com)(PORT=2484))"
      + "(CONNECT_DATA=(SERVICE_NAME=ORCL)));"
  + "SSL Server Cert DN=CN=mydb.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com;";

sudo curl -o /usr/local/share/ca-certificates/rds-ca.crt \
  https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
sudo update-ca-certificates

-- Protocol — 'tcps' for TLS
SELECT SYS_CONTEXT('USERENV','NETWORK_PROTOCOL') FROM dual;

-- Algorithm in use for NNE
SELECT network_service_banner FROM v$session_connect_info
WHERE sid = SYS_CONTEXT('USERENV','SID');