Using an Oracle database as a source for AWS DMS

1. Create a database link named, AWSDMS_DBLINK on the primary database. DMS_USER will use the database link to connect to the primary database. Note that the database link is executed from the standby instance to query the open transactions running on the primary database. See the following example.

   CREATE PUBLIC DATABASE LINK AWSDMS_DBLINK 
      CONNECT TO DMS_USER IDENTIFIED BY DMS_USER_PASSWORD
      USING '(DESCRIPTION=
               (ADDRESS=(PROTOCOL=TCP)(HOST=PRIMARY_HOST_NAME_OR_IP)(PORT=PORT))
               (CONNECT_DATA=(SERVICE_NAME=SID))
             )';         
           

2. Verify the connection to the database link using DMS_USER is established, as shown in the following example.

   select 1 from dual@AWSDMS_DBLINK

To manually set up supplemental logging

1. Run the following query to verify if supplemental logging is already enabled for the database.

   SELECT supplemental_log_data_min FROM v$database;

   If the result returned is YES or IMPLICIT, supplemental logging is enabled for the database.

   If not, enable supplemental logging for the database by running the following command.

   ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;

2. Make sure that the required supplemental logging is added for each replicated table.

   Consider the following:

   • If ALL COLUMNS supplemental logging is added to the table, you don't need to add more logging.

   • If a primary key exists, add supplemental logging for the primary key. You can do this either by using the format to add supplemental logging on the primary key itself, or by adding supplemental logging on the primary key columns on the database.

     ALTER TABLE Tablename ADD SUPPLEMENTAL LOG DATA (PRIMARY KEY) COLUMNS;
     ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (PRIMARY KEY) COLUMNS;

   • If no primary key exists and the table has a single unique index, add all of the unique index's columns to the supplemental log.

     ALTER TABLE TableName ADD SUPPLEMENTAL LOG GROUP LogGroupName (UniqueIndexColumn1[, UniqueIndexColumn2] ...) ALWAYS;

     Using SUPPLEMENTAL LOG DATA (UNIQUE INDEX) COLUMNS doesn't add the unique index columns to the log.

   • If no primary key exists and the table has multiple unique indexes, AWS DMS selects the first unique index in an alphabetically ordered ascending list. You need to add supplemental logging on the selected index’s columns as in the previous item.

     Using SUPPLEMENTAL LOG DATA (UNIQUE INDEX) COLUMNS doesn't add the unique index columns to the log.

   • If no primary key exists and there is no unique index, add supplemental logging on all columns.

     ALTER TABLE TableName ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;

     In some cases, the target table primary key or unique index is different than the source table primary key or unique index. In such cases, add supplemental logging manually on the source table columns that make up the target table primary key or unique index.

     Also, if you change the target table primary key, add supplemental logging on the target unique index's columns instead of the columns of the source primary key or unique index.

To configure an Oracle Standby instance as a source when using Binary Reader for CDC

1. Grant additional privileges required to access standby log files.

   GRANT SELECT ON v_$standby_log TO db_user;

2. Create a source endpoint for the Oracle Standby by using the AWS Management Console or AWS CLI. When creating the endpoint, specify the following extra connection attributes.

   useLogminerReader=N;useBfile=Y;

   Note

   In AWS DMS, you can use extra connection attributes to specify if you want to migrate from the archive logs instead of the redo logs. For more information, see Endpoint settings when using Oracle as a source for AWS DMS.

3. Configure archived log destination.

   DMS binary reader for Oracle source without ASM uses Oracle Directories to access archived redo logs. If your database is configured to use Fast Recovery Area (FRA) as an archive log destination, the location of archive redo files isn't constant. Each day that archived redo logs are generated results in a new directory being created in the FRA, using the directory name format YYYY_MM_DD. For example:

   DB_RECOVERY_FILE_DEST/SID/archivelog/YYYY_MM_DD

   When DMS needs access to archived redo files in the newly created FRA directory and the primary read-write database is being used as a source, DMS creates a new or replaces an existing Oracle directory, as follows.

   CREATE OR REPLACE DIRECTORY dmsrep_taskid AS ‘DB_RECOVERY_FILE_DEST/SID/archivelog/YYYY_MM_DD’;

   When the standby database is being used as a source, DMS is unable to create or replace the Oracle directory because the database is in read-only mode. But, you can choose to perform one of these additional steps:

   1. Modify log_archive_dest_id_1 to use an actual path instead of FRA in such a configuration that Oracle won't create daily subdirectories:

      ALTER SYSTEM SET log_archive_dest_1=’LOCATION=full directory path’

      Then, create an Oracle directory object to be used by DMS:

      CREATE OR REPLACE DIRECTORY dms_archived_logs AS ‘full directory path’;

   2. Create an additional archive log destination and an Oracle directory object pointing to that destination. For example:

      ALTER SYSTEM SET log_archive_dest_3=’LOCATION=full directory path’; 
      CREATE DIRECTORY dms_archived_log AS ‘full directory path’;
      

      Then add an extra connection attribute to the task source endpoint:

      archivedLogDestId=3

   3. Manually pre-create Oracle directory objects to be used by DMS.

      CREATE DIRECTORY dms_archived_log_20210301 AS ‘DB_RECOVERY_FILE_DEST/SID/archivelog/2021_03_01’;
      CREATE DIRECTORY dms_archived_log_20210302 AS ‘DB_RECOVERY_FILE_DEST>/SID>/archivelog/2021_03_02’; 
      ...
      

   4. Create an Oracle scheduler job that runs daily and creates the required directory.

To configure an OCI hosted user-managed Oracle database as a source for change data capture

1. Grant required user account privileges for a user-managed Oracle source database on OCI. For more information, see Account privileges for a self-managed Oracle source endpoint.

2. Grant account privileges required when using Binary Reader to access the redo logs. For more information, see Account privileges required when using Binary Reader.

3. Add account privileges that are required when using Binary Reader with Oracle Automatic Storage Management (ASM). For more information, see Additional account privileges required when using Binary Reader with Oracle ASM.

4. Set-up supplemental logging. For more information, see Setting up supplemental logging.

5. Set-up TDE encryption. For more information, see Encryption methods when using an Oracle database as a source endpoint.

1. Create a database link named, AWSDMS_DBLINK on the primary database. DMS_USER will use the database link to connect to the primary database. Note that the database link is executed from the standby instance to query the open transactions running on the primary database. See the following example.

   CREATE PUBLIC DATABASE LINK AWSDMS_DBLINK 
      CONNECT TO DMS_USER IDENTIFIED BY DMS_USER_PASSWORD
      USING '(DESCRIPTION=
               (ADDRESS=(PROTOCOL=TCP)(HOST=PRIMARY_HOST_NAME_OR_IP)(PORT=PORT))
               (CONNECT_DATA=(SERVICE_NAME=SID))
             )';         
           

2. Verify the connection to the database link using DMS_USER is established, as shown in the following example.

   select 1 from dual@AWSDMS_DBLINK

To set up archiving

1. Run the rdsadmin.rdsadmin_util.set_configuration command to set up archiving.

   For example, to retain the archived redo logs for 24 hours, run the following command.

   exec rdsadmin.rdsadmin_util.set_configuration('archivelog retention hours',24);
   commit;                      

   Note

   The commit is required for a change to take effect.

2. Make sure that your storage has enough space for the archived redo logs during the specified retention period. For example, if your retention period is 24 hours, calculate the total size of your accumulated archived redo logs over a typical hour of transaction processing and multiply that total by 24. Compare this calculated 24-hour total with your available storage space and decide if you have enough storage space to handle a full 24 hours transaction processing.

To set up supplemental logging

1. Run the following command to enable supplemental logging at the database level.

   exec rdsadmin.rdsadmin_util.alter_supplemental_logging('ADD');

2. Run the following command to enable primary key supplemental logging.

   exec rdsadmin.rdsadmin_util.alter_supplemental_logging('ADD','PRIMARY KEY');

3. (Optional) Enable key-level supplemental logging at the table level.

   Your source database incurs a small bit of overhead when key-level supplemental logging is enabled. Therefore, if you are migrating only a subset of your tables, you might want to enable key-level supplemental logging at the table level. To enable key-level supplemental logging at the table level, run the following command.

   alter table table_name add supplemental log data (PRIMARY KEY) columns;

To configure CDC using Binary Reader

1. Log in to your Amazon RDS for Oracle source database as the master user and run the following stored procedures to create the server-level directories.

   exec rdsadmin.rdsadmin_master_util.create_archivelog_dir;
   exec rdsadmin.rdsadmin_master_util.create_onlinelog_dir;

2. Grant the following privileges to the Oracle user account that is used to access the Oracle source endpoint.

   GRANT READ ON DIRECTORY ONLINELOG_DIR TO db_user;
   GRANT READ ON DIRECTORY ARCHIVELOG_DIR TO db_user;

3. Set the following extra connection attributes on the Amazon RDS Oracle source endpoint:

   • For RDS Oracle versions 11.2 and 12.1, set the following.

     useLogminerReader=N;useBfile=Y;accessAlternateDirectly=false;useAlternateFolderForOnline=true;
     oraclePathPrefix=/rdsdbdata/db/{$DATABASE_NAME}_A/;usePathPrefix=/rdsdbdata/log/;replacePathPrefix=true;

   • For RDS Oracle versions 12.2, 18.0, and 19.0, set the following.

     useLogminerReader=N;useBfile=Y;

To configure an RDS for Oracle Standby as a source when using Binary Reader for CDC

1. Sign in to RDS for Oracle primary instance as the master user.

2. Run the following stored procedures as documented in the Amazon RDS User Guide to create the server level directories.

   exec rdsadmin.rdsadmin_master_util.create_archivelog_dir;
   exec rdsadmin.rdsadmin_master_util.create_onlinelog_dir;

3. Identify the directories created in step 2.

   SELECT directory_name, directory_path FROM all_directories
   WHERE directory_name LIKE ( 'ARCHIVELOG_DIR_%' )
           OR directory_name LIKE ( 'ONLINELOG_DIR_%' )
   

   For example, the preceding code displays a list of directories like the following.

   

4. Grant the Read privilege on the preceding directories to the Oracle user account that is used to access the Oracle Standby.

   GRANT READ ON DIRECTORY ARCHIVELOG_DIR_A TO db_user;
   GRANT READ ON DIRECTORY ARCHIVELOG_DIR_B TO db_user;
   GRANT READ ON DIRECTORY ONLINELOG_DIR_A TO db_user;
   GRANT READ ON DIRECTORY ONLINELOG_DIR_B TO db_user;
   

5. Perform an archive log switch on the primary instance. Doing this makes sure that the changes to ALL_DIRECTORIES are also ported to the Oracle Standby.

6. Run an ALL_DIRECTORIES query on the Oracle Standby to confirm that the changes were applied.

7. Create a source endpoint for the Oracle Standby by using the AWS DMS Management Console or AWS Command Line Interface (AWS CLI). While creating the endpoint, specify the following extra connection attributes.

   useLogminerReader=N;useBfile=Y;archivedLogDestId=1;additionalArchivedLogDestId=2

8. After creating the endpoint, use Test endpoint connection on the Create endpoint page of the console or the AWS CLI test-connection command to verify that connectivity is established.

To use an existing oracle client installation for Oracle SSL with AWS DMS

1. Set the ORACLE_HOME system variable to the location of your dbhome_1 directory by running the following command.

   
   prompt>export ORACLE_HOME=/home/user/app/user/product/12.1.0/dbhome_1                        
   

2. Append $ORACLE_HOME/lib to the LD_LIBRARY_PATH system variable.

   
   prompt>export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib                        
   

3. Create a directory for the Oracle wallet at $ORACLE_HOME/ssl_wallet.

   
   prompt>mkdir $ORACLE_HOME/ssl_wallet
   

4. Put the CA certificate .pem file in the ssl_wallet directory. If you use Amazon RDS, you can download the rds-ca-2015-root.pem root CA certificate file hosted by Amazon RDS. For more information about downloading this file, see Using SSL/TLS to encrypt a connection to a DB instance in the Amazon RDS User Guide.

5. Run the following commands to create the Oracle wallet.

   
   prompt>orapki wallet create -wallet $ORACLE_HOME/ssl_wallet -auto_login_only
   prompt>orapki wallet add -wallet $ORACLE_HOME/ssl_wallet -trusted_cert -cert 
      $ORACLE_HOME/ssl_wallet/ca-cert.pem -auto_login_only                            
                           

To use a self-signed certificate for Oracle SSL with AWS DMS

1. Create a directory you will use to work with the self-signed certificate.

   mkdir -p /u01/app/oracle/self_signed_cert
   

2. Change into the directory you created in the previous step.

   cd /u01/app/oracle/self_signed_cert
   

3. Create a root key.

   openssl genrsa -out self-rootCA.key 2048
   

4. Self-sign a root certificate using the root key you created in the previous step.

   openssl req -x509 -new -nodes -key self-rootCA.key 
           -sha256 -days 3650 -out self-rootCA.pem
   

   Use input parameters like the following.

   • Country Name (2 letter code) [XX], for example: AU

   • State or Province Name (full name) [], for example: NSW

   • Locality Name (e.g., city) [Default City], for example: Sydney

   • Organization Name (e.g., company) [Default Company Ltd], for example: AmazonWebService

   • Organizational Unit Name (e.g., section) [], for example: DBeng

   • Common Name (e.g., your name or your server's hostname) [], for example: aws

   • Email Address [], for example: abcd.efgh@amazonwebservice.com

5. Create an Oracle wallet directory for the Oracle database.

   mkdir -p /u01/app/oracle/wallet
   

6. Create a new Oracle wallet.

   orapki wallet create -wallet "/u01/app/oracle/wallet" -pwd oracle123 -auto_login_local
   

7. Add the root certificate to the Oracle wallet.

   orapki wallet add -wallet "/u01/app/oracle/wallet" -pwd oracle123 -trusted_cert 
   -cert /u01/app/oracle/self_signed_cert/self-rootCA.pem
   

8. List the contents of the Oracle wallet. The list should include the root certificate.

   orapki wallet display -wallet /u01/app/oracle/wallet -pwd oracle123
   

   For example, this might display similar to the following.

   Requested Certificates:
   User Certificates:
   Trusted Certificates:
   Subject:        CN=aws,OU=DBeng,O= AmazonWebService,L=Sydney,ST=NSW,C=AU
   

9. Generate the Certificate Signing Request (CSR) using the ORAPKI utility.

   orapki wallet add -wallet "/u01/app/oracle/wallet" -pwd oracle123 
   -dn "CN=aws" -keysize 2048 -sign_alg sha256
   

10. Run the following command.

    openssl pkcs12 -in /u01/app/oracle/wallet/ewallet.p12 -nodes -out /u01/app/oracle/wallet/nonoracle_wallet.pem
    

    This has output like the following.

    Enter Import Password:
    MAC verified OK
    Warning unsupported bag type: secretBag
    

11. Put 'dms' as the common name.

    openssl req -new -key /u01/app/oracle/wallet/nonoracle_wallet.pem -out certdms.csr
    

    Use input parameters like the following.

    • Country Name (2 letter code) [XX], for example: AU

    • State or Province Name (full name) [], for example: NSW

    • Locality Name (e.g., city) [Default City], for example: Sydney

    • Organization Name (e.g., company) [Default Company Ltd], for example: AmazonWebService

    • Organizational Unit Name (e.g., section) [], for example: aws

    • Common Name (e.g., your name or your server's hostname) [], for example: aws

    • Email Address [], for example: abcd.efgh@amazonwebservice.com

    Make sure this is not same as step 4. You can do this, for example, by changing Organizational Unit Name to a different name as shown.

    Enter the additional attributes following to be sent with your certificate request.

    • A challenge password [], for example: oracle123

    • An optional company name [], for example: aws

12. Get the certificate signature.

    openssl req -noout -text -in certdms.csr | grep -i signature
    

    The signature key for this post is sha256WithRSAEncryption .

13. Run the command following to generate the certificate (.crt) file.

    openssl x509 -req -in certdms.csr -CA self-rootCA.pem -CAkey self-rootCA.key 
    -CAcreateserial -out certdms.crt -days 365 -sha256
    

    This displays output like the following.

    Signature ok
    subject=/C=AU/ST=NSW/L=Sydney/O=awsweb/OU=DBeng/CN=aws
    Getting CA Private Key
    

14. Add the certificate to the wallet.

    orapki wallet add -wallet /u01/app/oracle/wallet -pwd oracle123 -user_cert -cert certdms.crt
    

15. View the wallet. It should have two entries. See the code following.

    orapki wallet display -wallet /u01/app/oracle/wallet -pwd oracle123
    

16. Configure the sqlnet.ora file ($ORACLE_HOME/network/admin/sqlnet.ora).

    WALLET_LOCATION =
       (SOURCE =
         (METHOD = FILE)
         (METHOD_DATA =
           (DIRECTORY = /u01/app/oracle/wallet/)
         )
       ) 
    
    SQLNET.AUTHENTICATION_SERVICES = (NONE)
    SSL_VERSION = 1.0
    SSL_CLIENT_AUTHENTICATION = FALSE
    SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA)
    

17. Stop the Oracle listener.

    lsnrctl stop

18. Add entries for SSL in the listener.ora file ($ORACLE_HOME/network/admin/listener.ora).

    SSL_CLIENT_AUTHENTICATION = FALSE
    WALLET_LOCATION =
      (SOURCE =
        (METHOD = FILE)
        (METHOD_DATA =
          (DIRECTORY = /u01/app/oracle/wallet/)
        )
      )
    
    SID_LIST_LISTENER =
     (SID_LIST =
      (SID_DESC =
       (GLOBAL_DBNAME = SID)
       (ORACLE_HOME = ORACLE_HOME)
       (SID_NAME = SID)
      )
     )
    
    LISTENER =
      (DESCRIPTION_LIST =
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCP)(HOST = localhost.localdomain)(PORT = 1521))
          (ADDRESS = (PROTOCOL = TCPS)(HOST = localhost.localdomain)(PORT = 1522))
          (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
        )
      )
    

19. Configure the tnsnames.ora file ($ORACLE_HOME/network/admin/tnsnames.ora).

    <SID>=
    (DESCRIPTION=
            (ADDRESS_LIST = 
                    (ADDRESS=(PROTOCOL = TCP)(HOST = localhost.localdomain)(PORT = 1521))
            )
            (CONNECT_DATA =
                    (SERVER = DEDICATED)
                    (SERVICE_NAME = <SID>)
            )
    )
    
    <SID>_ssl=
    (DESCRIPTION=
            (ADDRESS_LIST = 
                    (ADDRESS=(PROTOCOL = TCPS)(HOST = localhost.localdomain)(PORT = 1522))
            )
            (CONNECT_DATA =
                    (SERVER = DEDICATED)
                    (SERVICE_NAME = <SID>)
            )
    )
    

20. Restart the Oracle listener.

    lsnrctl start

21. Show the Oracle listener status.

    lsnrctl status

22. Test the SSL connection to the database from localhost using sqlplus and the SSL tnsnames entry.

    sqlplus -L ORACLE_USER@SID_ssl

23. Verify that you successfully connected using SSL.

    SELECT SYS_CONTEXT('USERENV', 'network_protocol') FROM DUAL;
    
    SYS_CONTEXT('USERENV','NETWORK_PROTOCOL')
    --------------------------------------------------------------------------------
    tcps
    

24. Change directory to the directory with the self-signed certificate.

    cd /u01/app/oracle/self_signed_cert

25. Create a new client Oracle wallet for AWS DMS to use.

    orapki wallet create -wallet ./ -auto_login_only

26. Add the self-signed root certificate to the Oracle wallet.

    orapki wallet add -wallet ./ -trusted_cert -cert self-rootCA.pem -auto_login_only

27. List the contents of the Oracle wallet for AWS DMS to use. The list should include the self-signed root certificate.

    orapki wallet display -wallet ./

    This has output like the following.

    Trusted Certificates:
    Subject:        CN=aws,OU=DBeng,O=AmazonWebService,L=Sydney,ST=NSW,C=AU
    

28. Upload the Oracle wallet that you just created to AWS DMS.

To identify and specify encryption key and password for TDE encryption

1. Run the following query to find the Oracle encryption wallet on the Oracle database host.

   SQL> SELECT WRL_PARAMETER FROM V$ENCRYPTION_WALLET;
   
   WRL_PARAMETER
   --------------------------------------------------------------------------------
   /u01/oracle/product/12.2.0/dbhome_1/data/wallet/

   Here, /u01/oracle/product/12.2.0/dbhome_1/data/wallet/ is the wallet location.

2. Get the master key ID using one of the following encryption options, depending on which one returns this value.

   1. For table or column-level encryption, run the following queries.

      SQL> SELECT OBJECT_ID FROM ALL_OBJECTS 
      WHERE OWNER='DMS_USER' AND OBJECT_NAME='TEST_TDE_COLUMN' AND OBJECT_TYPE='TABLE';
      
      OBJECT_ID
      ---------------
      81046
      SQL> SELECT MKEYID FROM SYS.ENC$ WHERE OBJ#=81046;
      
      MKEYID
      ------------
      AWGDC9glSk8Xv+3bVveiVSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

      Here, AWGDC9glSk8Xv+3bVveiVSg is the master key ID (MKEYID). If you get a value for MKEYID, you can continue with Step 3. Otherwise, continue with Step 2.2.

      Note

      The trailing string 'A' characters (AAA...) is not part of the value.

   2. For tablespace-level encryption, run the following queries.

      SQL> SELECT TABLESPACE_NAME, ENCRYPTED FROM dba_tablespaces;
      TABLESPACE_NAME                ENC
      ------------------------------ ---
      SYSTEM                         NO
      SYSAUX                         NO
      UNDOTBS1                       NO
      TEMP                           NO
      USERS                          NO
      TEST_ENCRYT                    YES
      SQL> SELECT name,utl_raw.cast_to_varchar2( utl_encode.base64_encode('01'||substr(mkeyid,1,4))) || utl_raw.cast_to_varchar2( utl_encode.base64_encode(substr(mkeyid,5,length(mkeyid)))) masterkeyid_base64
      FROM (SELECT t.name, RAWTOHEX(x.mkid) mkeyid FROM v$tablespace t, x$kcbtek x WHERE t.ts#=x.ts#)
      WHERE name = 'TEST_ENCRYT';
      
      NAME                           MASTERKEYID_BASE64
      ------------------------------ ----------------------------------
      TEST_ENCRYT                    AWGDC9glSk8Xv+3bVveiVSg=
      

      Here, AWGDC9glSk8Xv+3bVveiVSg is the master key ID (TEST_ENCRYT). If both steps 2.1 and 2.2 return a value, they are always identical.

      The trailing '=' character is not part of the value.

3. From the command line, list the encryption wallet entries on the source Oracle database host.

   $ mkstore -wrl /u01/oracle/product/12.2.0/dbhome_1/data/wallet/ -list
   Oracle Secret Store entries:
   ORACLE.SECURITY.DB.ENCRYPTION.AWGDC9glSk8Xv+3bVveiVSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
   ORACLE.SECURITY.DB.ENCRYPTION.AY1mRA8OXU9Qvzo3idU4OH4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
   ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
   ORACLE.SECURITY.ID.ENCRYPTION.
   ORACLE.SECURITY.KB.ENCRYPTION.
   ORACLE.SECURITY.KM.ENCRYPTION.AY1mRA8OXU9Qvzo3idU4OH4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
   

   Find the entry containing the master key ID that you found in step 2 (AWGDC9glSk8Xv+3bVveiVSg). This entry is the TDE encryption key name.

4. View the details of the entry that you found in the previous step.

   $ mkstore -wrl /u01/oracle/product/12.2.0/dbhome_1/data/wallet/ -viewEntry ORACLE.SECURITY.DB.ENCRYPTION.AWGDC9glSk8Xv+3bVveiVSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
   Oracle Secret Store Tool : Version 12.2.0.1.0
   Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.
   Enter wallet password:
   ORACLE.SECURITY.DB.ENCRYPTION.AWGDC9glSk8Xv+3bVveiVSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AEMAASAASGYs0phWHfNt9J5mEMkkegGFiD4LLfQszDojgDzbfoYDEACv0x3pJC+UGD/PdtE2jLIcBQcAeHgJChQGLA==
   

   Enter the wallet password to see the result.

   Here, the value to the right of '=' is the TDE password.

5. Specify the TDE encryption key name for the Oracle source endpoint by setting the securityDbEncryptionName extra connection attribute.

   securityDbEncryptionName=ORACLE.SECURITY.DB.ENCRYPTION.AWGDC9glSk8Xv+3bVveiVSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

6. Provide the associated TDE password for this key on the console as part of the Oracle source's Password value. Use the following order to format the comma-separated password values, ended by the TDE password value.

   Oracle_db_password,ASM_Password,AEMAASAASGYs0phWHfNt9J5mEMkkegGFiD4LLfQszDojgDzbfoYDEACv0x3pJC+UGD/PdtE2jLIcBQcAeHgJChQGLA==
   

   Specify the password values in this order regardless of your Oracle database configuration. For example, if you're using TDE but your Oracle database isn't using ASM, specify password values in the following comma-separated order.

   Oracle_db_password,,AEMAASAASGYs0phWHfNt9J5mEMkkegGFiD4LLfQszDojgDzbfoYDEACv0x3pJC+UGD/PdtE2jLIcBQcAeHgJChQGLA==