Managing a DB instance in a self-managed Active Directory domain

You can use the AWS Management Console, the AWS CLI, or the Amazon RDS API to manage your Amazon RDS for Oracle DB instance and its relationship with your self-managed Active Directory (AD) domain. For example, you can move the DB instance into, out of, or between domains.

For example, with the AWS CLI you can do the following:

• To retry a domain join that failed, run modify-db-instance with the same four parameters: --domain-fqdn, --domain-ou, --domain-auth-secret-arn, and --domain-dns-ips.

• To remove a DB instance from the domain, run modify-db-instance with the --disable-domain option.

• To move a DB instance to another self-managed domain, run modify-db-instance with the four domain parameters, --domain-fqdn, --domain-ou, --domain-auth-secret-arn, and --domain-dns-ips, for the new domain.

• To view the domain membership of a DB instance, run describe-db-instances and check the DomainMemberships field.

Rotating the domain service account credentials

Amazon RDS uses the domain service account to maintain the user object for each DB instance and to rotate its Kerberos keys, not to authenticate your database users. When you change the password of the domain service account in AD, update the secret in Secrets Manager with the new password. Amazon RDS reads the updated secret automatically, so you don't need to modify or reboot the DB instance.

To update the secret, create a file named smad-secret.json with the following content. Replace service-account with the name of the domain service account that you created in Step 2 of Setting up self-managed Active Directory, such as rds-join-svc, and your-new-service-account-password with your new password.

{
    "SELF_MANAGED_ACTIVE_DIRECTORY_USERNAME": "service-account",
    "SELF_MANAGED_ACTIVE_DIRECTORY_PASSWORD": "your-new-service-account-password"
}

Replace arn:aws:secretsmanager:us-west-2:123456789012:secret:my-ad-secret-AbCdEf with your secret Amazon Resource Name (ARN) and run the following commands.

For Linux, macOS, or Unix:

aws secretsmanager put-secret-value \
    --secret-id "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-ad-secret-AbCdEf" \
    --secret-string file://smad-secret.json

For Windows:

aws secretsmanager put-secret-value ^
    --secret-id "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-ad-secret-AbCdEf" ^
    --secret-string file://smad-secret.json

Force-rotating Kerberos keys

Amazon RDS for Oracle rotates the Kerberos keys of the DB instance service account every 45 days. You don't need to take any action.

You can use the following Amazon RDS procedure to force the rotation of this key.

SELECT rdsadmin.rdsadmin_kerberos_auth_tasks.rotate_kerberos_keytab AS TASK_ID FROM DUAL;

The SELECT statement returns the ID of the task in a VARCHAR2 data type. You can view the status of an ongoing task in a bdump file. The bdump files are located in the /rdsdbdata/log/trace directory. Each bdump file name is in the following format.

dbtask-task-id.log

You can view the result by displaying the task's output file.

SELECT text FROM table(rdsadmin.rds_file_util.read_text_file('BDUMP','dbtask-task-id.log'));

Replace task-id with the task ID returned by the procedure.

Note

Tasks are executed asynchronously.