Configure Oracle Database Vault on Autonomous Database (ADB)

Oracle Autonomous Database offers a rich security framework out of the box, and Database Vault (DV) adds another layer of protection by enforcing strict access controls—even for highly privileged users. This blog post walks you through configuring Database Vault on an Autonomous Database (ADB), complete with schema setup, realm creation, and data verification.

---

 Prerequisites

• Oracle Autonomous Database (ATP or ADW) instance.

• Admin access to the ADB.

• SQL Developer or OCI CLI for executing SQL commands.

---

 Step 1: Create Schema & Load Sample Data

First, create a user HR and a sample EMPLOYEE table to protect using Database Vault.

sql
CREATE USER hr IDENTIFIED BY ORacle1234##;
GRANT CONNECT, RESOURCE TO hr;
ALTER USER hr QUOTA UNLIMITED ON DATA;

CREATE TABLE hr.employee (
  id NUMBER,
  salary NUMBER
);

INSERT INTO hr.employee VALUES (101, 20000);
INSERT INTO hr.employee VALUES (102, 30000);
COMMIT;

---

Step 2: Check Database Vault & Label Security Status

Verify if Database Vault and Oracle Label Security (OLS) are configured.

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

---

 Step 3: Create Local Users for Database Vault Roles

Create two new users to act as DV Owner and DV Account Manager.

sql
GRANT CREATE SESSION TO adb_dv_root IDENTIFIED BY ORacle1234##;
GRANT CREATE SESSION TO adb_dv_acctmgr IDENTIFIED BY ORacle1234##;

Re-verify the security components:

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

---

 Step 4: Configure & Enable Database Vault

Run the following procedure to configure Database Vault with the designated users:

sql
EXEC DBMS_CLOUD_MACADM.CONFIGURE_DATABASE_VAULT(
  'adb_dv_root', 
  'adb_dv_acctmgr'
);

Then enable Database Vault:

sql
EXEC DBMS_CLOUD_MACADM.ENABLE_DATABASE_VAULT;

Check the status again:

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

---

Step 5: Restart the ADB Instance

Restart your ADB instance from the OCI Console or use dbaascli if enabled. Once restarted, confirm the services are up:

sql
SELECT * FROM SYS.DBA_DV_STATUS;
SELECT * FROM DBA_OLS_STATUS;

---

 Step 6: Create a Realm on HR Schema

Connect as DV Owner (adb_dv_root) from SQL Developer and define a realm on the HR schema:

sql
BEGIN
  DBMS_MACADM.CREATE_REALM(
    realm_name    => 'HR_REALM',
    description   => 'Realm for HR Schema',
    enabled       => DBMS_MACUTL.G_YES,
    audit_options => DBMS_MACUTL.G_REALM_AUDIT_FAIL + 
                     DBMS_MACUTL.G_REALM_AUDIT_SUCCESS
  );
END;
/

BEGIN
  DBMS_MACADM.ADD_OBJECT_TO_REALM(
    realm_name   => 'HR_REALM',
    object_owner => 'HR',
    object_name  => '%',
    object_type  => '%'
  );
END;
/

---

Step 7: Verify the Realm Enforcement

Now, try accessing the hr.employee table as a regular ADMIN user:

sql
SELECT * FROM hr.employee;

You should receive a permission error unless the admin user is explicitly granted access to the realm, confirming Database Vault is working as expected.

---

Conclusion

With Database Vault, you can enforce powerful separation-of-duty controls and protect sensitive application data even from highly privileged users. It’s an essential feature for any organization looking to strengthen security and compliance on Oracle Autonomous Database.

---

Author: Bidhan Mandal
Oracle Apps DBA | OCI Architect | EBS Expert
Follow for more: https://bidhandba.blogspot.com