\nAWS has just added the possibility to create your oracle Database as as CDB (Container Database), the “new” architecture of Oracle where an instance can manage multiple databases, adding a new level between the heavy instance and lightweight schema:
\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/Screenshot-2021-05-26-134410.jpg\")
<\/a>\nAt the time I’m writing this, I see it only in the “old” console (“original interface”) not in “new database creation flow”. It is displayed as a different Edition, however it is exactly the same price even when license is included.<\/p>\n
The CDB name is always RDSCDB but you can choose the PDB name as “Database name” – I left the default “ORCL” here:<\/p>\n
\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n select con_id, cdb, dbid, con_dbid, name, created, log_mode, open_mode, database_role, force_logging, platform_name, flashback_on, db_unique_name from v$database;\n\n CON_ID CDB DBID CON_DBID NAME CREATED LOG_MODE OPEN_MODE DATABASE_ROLE FORCE_LOGGING PLATFORM_NAME FLASHBACK_ON DB_UNIQUE_NAME\n_________ ______ ________________ ______________ _________ ____________ _______________ _____________ ________________ ________________ ___________________ _______________ _________________\n 0 YES 3,360,638,310 490,545,968 RDSCDB 07-MAY-21 NOARCHIVELOG READ WRITE PRIMARY NO Linux x86 64-bit NO RDSCDB_A\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\nSELECT pdb_id,pdb_name,dbid,con_uid,guid,status,con_id FROM dba_pdbs;\n\n PDB_ID PDB_NAME DBID CON_UID GUID STATUS CON_ID\n_________ ___________ ______________ ______________ ___________________________________ _________ _________\n 3 ORCL 490,545,968 490,545,968 C3395C709E011676E0530100007F3932 NORMAL 3\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL> \n\nselect service_id, name, network_name, creation_date, pdb, sql_translation_profile from dba_services;\n\n SERVICE_ID NAME NETWORK_NAME CREATION_DATE PDB SQL_TRANSLATION_PROFILE\n_____________ _______ _______________ ________________ _______ __________________________\n 7 ORCL ORCL 26-MAY-21 ORCL\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n<\/code><\/pre>\nThis is not a best practice, but there’s no services declared there which mean that I can connect only with the default service registered from the PDB name. The documentation <\/a>even recommends to connect with (CONNECT_DATA=(SID=pdb_name)) – I filled a feedback about this as this is a bad practice for 20 years.<\/p>\nI use EZCONNECT and create my own service:<\/p>\n
ORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\nconnect oracle19c\/franck@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL\nConnected.\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n exec dbms_service.start_service(service_name=>'MY_APP')\n\nPL\/SQL procedure successfully completed.\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL> select name,network_name,creation_date,con_id from v$active_services\n 2 \/\n\n NAME NETWORK_NAME CREATION_DATE CON_ID\n_________ _______________ ________________ _________\norcl orcl 26-MAY-21 3\nMY_APP MY_APP 26-MAY-21 3\n\n<\/code><\/pre>\nI can now connect as oracle19c\/franck@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/MY_APP<\/p>\n
Even if it is multitenant and I have only one PDB there, the whole CDB is mine:<\/p>\n
\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL> \n\nselect listagg(rownum ||': '||con_id_to_con_name(rownum),', ') con_name from xmltable('1 to 5000') where con_id_to_con_name(rownum) is not null;\n\n CON_NAME\n____________________________________\n1: CDB$ROOT, 2: PDB$SEED, 3: ORCL\n\n<\/code><\/pre>\nThis lists all containers around me. Of course, I cannot go to CDB$ROOT as I have only a local user here.<\/p>\n
\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL> \n\nshow parameter max_pdbs\n\nNAME TYPE VALUE\n-------- ------- -----\nmax_pdbs integer 5\n\n<\/code><\/pre>\nThe MAX_PDBS is set to 5 anyway because of Oracle detection of AWS hypervisor (see Oracle disables your multitenant option when you run on EC2<\/a>)<\/p>\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n select listagg(role,',') within group (order by role) from session_roles;\n\n LISTAGG(ROLE,',')\n______________________________________________________________________________________________________________________________________________________________\nAQ_ADMINISTRATOR_ROLE,AQ_USER_ROLE,CAPTURE_ADMIN,CONNECT,CTXAPP,DATAPUMP_EXP_FULL_DATABASE,DATAPUMP_IMP_FULL_DATABASE,DBA,EM_EXPRESS_ALL,EM_EXPRESS_BASIC\n,EXECUTE_CATALOG_ROLE,EXP_FULL_DATABASE,GATHER_SYSTEM_STATISTICS,HS_ADMIN_EXECUTE_ROLE,HS_ADMIN_SELECT_ROLE,IMP_FULL_DATABASE,OEM_ADVISOR,OEM_MONITOR\n,OPTIMIZER_PROCESSING_RATE,PDB_DBA,RDS_MASTER_ROLE,RECOVERY_CATALOG_OWNER,RESOURCE,SCHEDULER_ADMIN,SELECT_CATALOG_ROLE,SODA_APP,XDBADMIN,XDB_SET_INVOKER\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n select * from dba_sys_privs where grantee='PDB_DBA';\n\n GRANTEE PRIVILEGE ADMIN_OPTION COMMON INHERITED\n__________ ____________________________ _______________ _________ ____________\nPDB_DBA CREATE PLUGGABLE DATABASE NO NO NO\nPDB_DBA CREATE SESSION NO NO NO\n\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n show parameter pdb_lockdown\n\nNAME TYPE VALUE\n------------ ------ ---------------------\npdb_lockdown string RDSADMIN_PDB_LOCKDOWN\n\nORACLE19C@\/\/pdb.cywlwrcont2f.us-east-1.rds.amazonaws.com\/ORCL>\n\n select * from v$lockdown_rules;\n\n RULE_TYPE RULE CLAUSE CLAUSE_OPTION STATUS USERS CON_ID\n____________ ___________________________ _____________________________ ________________ __________ ________ _________\nSTATEMENT ALTER PLUGGABLE DATABASE DISABLE ALL 3\nSTATEMENT ALTER PLUGGABLE DATABASE ADD SUPPLEMENTAL LOG DATA ENABLE ALL 3\nSTATEMENT ALTER PLUGGABLE DATABASE DROP SUPPLEMENTAL LOG DATA ENABLE ALL 3\nSTATEMENT ALTER PLUGGABLE DATABASE ENABLE FORCE LOGGING ENABLE ALL 3\nSTATEMENT ALTER PLUGGABLE DATABASE OPEN RESTRICTED FORCE ENABLE ALL 3\nSTATEMENT ALTER PLUGGABLE DATABASE RENAME GLOBAL_NAME ENABLE ALL 3\n\n<\/code><\/pre>\nI have many roles, including RDS_MASTER_ROLE, DBA and PDB_DBA (CREATE PLUGGABLE DATABASE) and it seems that the only lockdown profile rues are about ALTER PLUGGABLE DATABASE.<\/p>\n