Google Cloud Key Management Integration for Exadata Database Service on Exascale Infrastructure@Google Cloud

To view the details of an identity connector attached to a VM cluster, use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Exascale Infrastructure.

   The VM clusters page is selected by default.

2. From the list of VM Clusters, select the cluster of your choice.
3. On the resulting VM Cluster Details page, in the Multicloud Information section, confirm that the Identity connector field displays the identity connector attached to this VM cluster.
4. Click the name of the Identity Connector to view its details.

   You will be redirected to the Database Multicloud Integrations portal.

To create a key ring, use this procedure.

1. Open the Google Cloud Console, navigate to the Key Management page.
2. Click Create key ring.
3. Provide the following details:
   • Name: Enter a descriptive name for the key ring.
   • Location: Select a location for your key ring.
     Important:

     • Key rings with the same name can exist in different locations, so you must always specify the location.
     • Choose a location close to the resources you want to protect.
     • For Customer Managed Encryption Keys, ensure the key ring is in the same location as the resources that will use it.

     Choosing a location for your Key Ring:

     When creating a key ring in Google Cloud Key Management Service (KMS), selecting the right location is crucial. Your choice affects where your cryptographic keys are stored and how they're replicated. For more information, see Cloud KMS locations.

     • Region:
       • Data is stored in a specific geographic region.
       • Keys remain within the boundaries of this single region.
       • Ideal for:
         • Low-latency applications
         • Compliance with data residency requirements
         • Region-specific workloads
     • Multi-region:
       • Data is replicated across multiple regions within a larger geographical area.
       • Google manages distribution and replication automatically.
       • You cannot select individual data centers or regions.
       • Ideal for:
         • High availability
         • Resilient, fault-tolerant applications
         • Services serving a wide regional area
     • Global:
       • A special type of multi-region.
       • Keys are distributed across Google data centers worldwide.
       • Location selection and control are not available.
       • Ideal for:
         • Applications with global users
         • Use cases needing maximum redundancy and reach
4. Click Create.

Once the key ring is created, you can begin creating and managing encryption keys within it.

To create a raw symmetric encryption key in the specified key ring and location, use this procedure.

1. Open the Google Cloud Console, navigate to the Key Management page.
2. Click the name of the key ring where you want to create the key.
3. Click Create key.
4. Provide the following details:
   • Key name: Enter a descriptive name for your key.
   • Protection level: Choose Software or HSM (Hardware Security Module).

     The protection level of a key can't be changed after the key is created. For more information, see Protection levels.

   • Key material: Select Generate key or Import key.

     Generate key material in Cloud KMS or import key material that is maintained outside of Google Cloud. For more information, see Customer-managed encryption keys (CMEK).

   • Purpose and Algorithm:

     For more information, see Key purposes and algorithms.

     • Set Purpose to Raw encryption/decryption.
     • For Algorithm, select AES-256-CBC.
5. Click Create.

After creation, you can use this key for cryptographic operations that require AES-CBC encryption and decryption.

To allow a key to be discoverable in Oracle Cloud Infrastructure (OCI), use this procedure.

1. In Google Cloud KMS, select the key you want to make discoverable.
2. Navigate to the Permissions tab and click Add principal.
3. In the New principals field, enter the service account associated with your Workload Resource Service Agent.
   Note
   
   

   You can find this service account on the Identity Connector details page, under the GCP Information section. Look for the Workload resource service agent and note its ID — this is the required service account.

4. Under Assign roles, add a role of your choice.
   Note
   
   

   Create a custom role with the following minimum permissions and assign it to the key ring of your choice.

   These permissions together allow OCI to:

   • Discover KMS resources like key rings and keys.
   • Access metadata about keys and their versions.
   • Use the keys for cryptographic operations (encryption/decryption).
   • Create key versions.

   Minimum Required Permissions:

   • cloudkms.cryptoKeyVersions.get

     Allows retrieval of metadata for a specific key version.

   • cloudkms.cryptoKeyVersions.manageRawAesCbcKeys

     Enables management of raw AES-CBC key material (import, rotation, and so on).

   • cloudkms.cryptoKeyVersions.create

     Allows creation of new key versions within a key.

   • cloudkms.cryptoKeyVersions.list

     Lists all versions of a given key.

   • cloudkms.cryptoKeyVersions.useToDecrypt

     Grants permission to use a key version for decrypting data.

   • cloudkms.cryptoKeyVersions.useToEncrypt

     Grants permission to use a key version for encrypting data.

   • cloudkms.cryptoKeys.get

     Allows retrieval of metadata for a key.

   • cloudkms.cryptoKeys.list

     Lists all keys within a key ring.

   • cloudkms.keyRings.get

     Allows retrieval of metadata for a key ring.

   • cloudkms.locations.get

     Retrieves information about supported key locations.

5. Click Save to apply the changes.
6. Click Refresh to confirm that the updated permissions have taken effect.

To enable Google Cloud Customer Managed Encryption Keys (CMEK) for your VM cluster, you must first register the GCP Key Ring in OCI.

1. In the Database Multicloud Integrations portal, navigate to: Google Cloud Integration > GCP Key Rings.
2. Click GCP Key Ring,
3. Click Register GCP key rings
4. On the resulting Register GCP key rings page, provide the following details:
   • Compartment: Select the compartment where the VM cluster resides.
   • Identity Connector: Choose the Identity Connector attached to the VM cluster.
   • Key Ring: Enter the name of the GCP key ring to register.

     To discover all available key rings through a single identity connector, you must grant the following permissions to that identity connector. These permissions should be assigned at the appropriate project or folder level to ensure the connector can access all key rings across the intended scope.

     • cloudkms.keyRings.list

       Allows listing all key rings within a project.

     • cloudkms.locations.get

       Allows retrieving metadata for a specific key ring.

5. Click Discover to verify if the key ring exists in GCP.

   If successful, the key ring’s details will be displayed.

   Note
   
   

   Only key rings can be registered — not individual keys. All supported keys associated with a registered key ring will be available, provided the required permissions are in place.

6. Click Register.

To enable GCP CMEK for your VM Cluster, use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Exascale Infrastructure.

   The VM clusters page is selected by default.

2. From the list of VM Clusters, select the cluster you want to configure.
3. On the VM Cluster Details page, scroll to the Multicloud Information section and click Enable next to GCP CMEK.
4. To disable GCP CMEK, click Disable.

This topic describes only the steps for creating a database and using GCP Customer-managed encryption key (CMEK) as the key management solution.

For the generic database creation procedure, see To Create a Database in an Existing Oracle Exadata Database Service on Exascale Infrastructure VM Cluster.

To change encryption keys between different encryption methods, use this procedure.

1. Navigate to your database details page in the OCI console.
2. In the Encryption section, verify that Key management is set to Oracle Wallet, and then click the Change link.
3. Enter the following information on the Change key management page.
   1. Select your Key management as GCP Customer Managed Encryption Key from the drop-down list.
   2. Select the compartment you are using, and then choose the Key Ring available in that compartment.
   3. Next, select the Key compartment you are using, and then choose the desired Key from the drop-down list.
   4. Click Save changes.

To rotate the GCP Customer Managed Encryption Key of a container database (CDB), use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Exascale Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM Clusters, click the name of the VM cluster that contains the database that you want to rotate encryption keys.
4. Click Container Databases.
5. Click the name of the database that you want to rotate encryption keys.

   The Database Details page displays information about the selected database.

6. In the Encryption section, verify that the Key Management is set to GCP Customer Managed Encryption Key, and then click the Rotate link.
7. On the resulting Rotate Key dialog, click Rotate to confirm the action.

To rotate the GCP Customer Managed Encryption Key of a pluggable database (PDB), use this procedure.

1. Open the navigation menu. Click Oracle AI Database, then click Oracle Exadata Database Service on Exascale Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM clusters, click the name of the VM cluster that contains the PDB you want to start, and then click its name to display the details page.
4. Under Container Databases, find the database containing the PDB you want to rotate encryption keys.
5. Click the name of the database to view the Database Details page.
6. Click Pluggable Databases in the Resources section of the page.

   A list of existing PDBs in this database is displayed.

7. Click the name of the PDB that you want to rotate encryption keys.

   The pluggable details page is displayed.

8. In the Encryption section displays that the Key management is set as GCP Customer Managed Encryption Key.
9. Click the Rotate link.
10. On the resulting Rotate Key dialog, click Rotate to confirm the action.