Configure Oracle Database Vault Realms to Secure the HR Schema

Oracle Database Vault (DV) is a powerful security feature that enables fine-grained access control by enforcing security policies that protect sensitive data.
One of the most important components in Database Vault is the Realm, which creates a security boundary around database objects to prevent unauthorized access — even by highly privileged users.

In this blog, we’ll walk through the step-by-step process of configuring a Realm to secure the HR schema in an Oracle Database 19c environment.
You’ll learn how to:

Create a Realm
Add objects to it
Restrict access
Enable auditing for security tracking

What is a Realm?

A Realm in Oracle Database Vault defines a logical security boundary around one or more database objects. Once a Realm is in place, no one — not even privileged users like DBAs — can access the protected objects without being explicitly authorized.

Realms are ideal for:

Securing sensitive application data (e.g., HR, Finance)
Enforcing separation of duties in compliance-driven environments
Preventing data breaches caused by insider threats

Step-by-Step Guide to Configuring a Realm

Step 1: Select Data from the HR Schema (Before Realm Setup)

First, try selecting data from the HR schema to see the current level of access.

sql
SELECT * FROM hr.employees;

At this point, access is typically allowed without restriction.

Step 2: Connect as the DV Owner

To create and manage Realms, you need to log in as a Database Vault Owner — often a common user like c##dv_owner_root.

bash
sqlplus c##dv_owner_root@pdb1

This user has privileges to create Realms and manage Database Vault policies.

Step 3: Create the Realm for the HR Schema

Create a Realm to secure all objects in the HR schema.

sql
BEGIN
  DBMS_MACADM.CREATE_REALM(
    realm_name   => 'HR_REALM',
    description  => 'Realm for HR Schema',
    enabled      => DBMS_MACUTL.G_YES,
    audit_options => DBMS_MACUTL.G_REALM_AUDIT_FAIL +
                     DBMS_MACUTL.G_REALM_AUDIT_SUCCESS
  );
END;
/

Audit Options:
Here, we enable auditing for both failed and successful access attempts. This allows us to track who tried to access the protected data.

Step 4: Add Objects to the Realm

Add all HR schema objects to the Realm. The % wildcard ensures all object names and types are included.

sql
BEGIN
  DBMS_MACADM.ADD_OBJECT_TO_REALM(
    realm_name   => 'HR_REALM',
    object_owner => 'HR',
    object_name  => '%',
    object_type  => '%'
  );
END;
/

Now, all HR schema objects are protected under HR_REALM.

Step 5: Test Realm Enforcement

Try accessing the HR schema again:

sql
SELECT * FROM hr.employees;

If your user or role is not authorized to access HR_REALM, you will receive an access violation error, even if you are a DBA.

Summary of Steps

Step	Action	Result
1	Select data from HR schema	Access allowed
2	Connect as `c##dv_owner_root`	Success
3	Create a Realm on the HR schema	`HR_REALM` created
4	Add objects to the Realm	All HR schema objects protected
5	Select data from HR schema again	Access denied (if unauthorized)

Best Practices for Realms

Enable Auditing – Always enable auditing for Realms to detect unauthorized access attempts.
Granular Protection – Protect only critical objects if full schema protection is unnecessary.
Role-Based Access – Grant Realm access via roles to simplify management.

References

Oracle Database Vault Realms Documentation

Why Use Realms?

Enforce fine-grained access control
Protect sensitive data from privileged users
Achieve compliance with industry regulations
Prevent unauthorized insider access

Realms are a cornerstone of a Zero Trust approach to database security. If you’re working in a regulated or security-conscious environment, they are essential.

Author: Bidhan Mandal
Oracle Apps DBA | Oracle Database Vault Specialist | OCI Architect
Visit: https://bidhandba.blogspot.com

Search This Blog

ORACLE ADVANCE DBA