Oracle Database 19c on AWS User Guide

Overview

This image is Oracle Database 19c Enterprise Edition (19.3.0.0.0) on Windows Server 2019 Datacenter, one software version of the cloudimg Hardened AMIs for Oracle Database 19c & 21c Enterprise on Windows Server listing on AWS Marketplace. Every version in the listing is described at /guides/oracle-database-enterprise-edition-windows-aws/.

Bring your own Oracle licence. This image includes no Oracle licence. You must hold Oracle Database Enterprise Edition licences (processor or Named User Plus) covering the instance under Oracle's cloud licensing policy. The Windows Server licence is included in the EC2 charge.

The database is created on your instance at first boot. Allow about 45 minutes after launch on an m5.large before the database is ready (measured on four fresh 2-vCPU, 8 GiB instances: 32 to 42 minutes; the first read of a new volume is the slow part). The progress log is C:\ProgramData\cloudimg\oracle-firstboot.log.

What cloudimg does to the image:

• No database and no password in the image. The AMI contains the Oracle software only (an Oracle home installed from Oracle's base release media). On first boot your instance creates the container database ORCL with the pluggable database ORCLPDB1, and generates its own SYS, SYSTEM and PDBADMIN passwords. Nothing database-related is shared between instances: each one has its own database ID and passwords.
• Passwords that only Administrators can read. The passwords are written to C:\ProgramData\cloudimg\oracle\oracle-db-credentials.txt, which only the Administrators group and SYSTEM can open. They are never put on a command line or in a log. Before the file is written, first boot proves that each new password logs in and that a wrong one is refused. If anything fails, the database stays stopped and no credentials are written.
• Listener on localhost. The Oracle listener is bound to 127.0.0.1:1521. Port 1521 is closed in the listing's security group and in the Windows Firewall. Enterprise Manager Express and the shared-server dispatcher are not started, so no Oracle process listens on the network.
• Oracle processes cannot reach the instance metadata service. Outbound Windows Firewall rules block every Oracle program (the database, the listener, external procedures and jobs, the bundled Java) from 169.254.169.254. A URL fetch from SQL (UTL_HTTP, UTL_TCP) can never read the instance's AWS credentials.
• Oracle home without a password. The Oracle services run under Windows virtual accounts (NT SERVICE\OracleServiceORCL), so there is no Oracle home user password to manage.
• Base release, no Oracle patches. Oracle Database 19.3.0.0.0 is installed from Oracle's base release media with no Release Update applied. Apply Release Updates with your own Oracle support entitlement (see Patching).
• Microsoft Security Baseline for Windows Server 2019 (Member Server), applied with Microsoft's LGPO tool and measured with HardeningKitty on a fresh instance: 300 of 300 scored rules pass (100%), with 8 rules waived for EC2 (listed below). The report ships in C:\ProgramData\cloudimg\baseline\. This is a measurement made with open-source tooling against Microsoft's published baseline, not a certification by Microsoft or any other body.
• Fully patched Windows at build time (OS build 17763.9376, the October 2026 cumulative update). The build fails if any update is still pending or a reboot is owed.
• A unique Administrator password on every instance (Sysprep through EC2Launch v2; retrieve it with your key pair). Remote Desktop requires Network Level Authentication, SMBv1 is off, and the Windows Firewall allows inbound Remote Desktop (3389) only.
• IMDSv2 only, and no build residue: build tools, installers, the Oracle installer logs, history and event logs are removed and free space is wiped before capture.

Connecting to your instance

Connect with Remote Desktop as the Administrator:

Launch from AWS Marketplace

1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose Oracle Database 19c EE on Windows Server 2019 as the software version, your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended starting size; use a larger instance for production. The database uses 40% of the instance's memory.
4. Choose a key pair. You need its private key to get the Administrator password.
5. Use a security group that allows RDP (TCP 3389) from your own address only. Do not open 1521.
6. Optional but recommended: attach an IAM instance profile with the AmazonSSMManagedInstanceCore policy, so you can reach the database from your workstation with Session Manager port forwarding (see Connect from your workstation) without opening any port.
7. Launch. The root volume is 100 GiB (the Oracle home plus your database); you can choose a larger volume at launch.

First boot: the database is created on your instance

After Windows finishes its first boot, a one-time task creates the database. Windows setup takes about 6 to 8 minutes and creating the database 26 to 35 minutes on an m5.large (allow 45 minutes in all; larger instances are faster); the Administrator password is ready after about four minutes, so you can sign in and watch. Check progress in PowerShell:

Get-Content C:\ProgramData\cloudimg\oracle-firstboot.log -Tail 15

The database is ready when the log ends with READY and the ready marker exists:

Get-Content C:\ProgramData\cloudimg\oracle-firstboot.done | ConvertFrom-Json |
  Select-Object ok, seconds, dbid, sid, pdb, version, finishedUtc

seconds is how long your database took to create; dbid is your database's own ID. To follow the log live in a Remote Desktop session, run Get-Content C:\ProgramData\cloudimg\oracle-firstboot.log -Wait.

If first boot fails, the file C:\ProgramData\cloudimg\oracle-firstboot.failed says why, the database stays stopped and no passwords are written. Restart the instance to try again (up to three attempts; each one starts from a clean slate), or contact cloudimg support.

Get the Administrator password

In the EC2 console select the instance, choose Actions, Security, Get Windows password, upload the private key of your key pair and choose Decrypt password. Or with the AWS CLI on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password yet; try again a minute later.

Connect over Remote Desktop

Connect to the instance's public DNS name or IP address on port 3389 with a Remote Desktop client that supports Network Level Authentication (Microsoft Remote Desktop on Windows and macOS, FreeRDP on Linux), as Administrator with the password from the previous step. Each instance generates its own Remote Desktop certificate, so your client asks you to trust it on first connection.

Read your database passwords

Open an elevated PowerShell (or File Explorer) in the Remote Desktop session and read the credentials file:

Get-Content C:\ProgramData\cloudimg\oracle\oracle-db-credentials.txt

Store them in your password manager. If you copy them anywhere else, change them (see Change the passwords).

Connect with SQL*Plus on the instance

The local Administrator is a member of the ORA_DBA group, so SQL*Plus on the instance can connect as SYSDBA with operating system authentication (no password). Check the database:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe'
@"
SET PAGESIZE 50 LINESIZE 150
SELECT name, dbid, open_mode, cdb, created FROM v`$database;
SELECT con_id, name, open_mode FROM v`$pdbs;
SELECT banner_full FROM v`$version;
EXIT
"@ | & $sqlplus -S / as sysdba

Operating system authentication means any member of the local Administrators (or ORA_DBA) group on the instance can connect as SYSDBA without a password, which is how Oracle on Windows works by design. Connections from anywhere else always need the password: the listener is loopback-only, and a client that is not a local administrator must give SYS's password.

To work in the pluggable database as SYSTEM or PDBADMIN, connect through the listener; SQL*Plus prompts for the password, so it never appears on the command line:

sqlplus system@//127.0.0.1:1521/ORCLPDB1
sqlplus pdbadmin@//127.0.0.1:1521/ORCLPDB1
sqlplus sys@//127.0.0.1:1521/ORCL as sysdba

Only SYS, SYSTEM and PDBADMIN are open accounts; Oracle's other built-in accounts stay locked. List them:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe'
@"
SET PAGESIZE 50 LINESIZE 150
SELECT con_id, username, account_status FROM cdb_users WHERE account_status = 'OPEN' ORDER BY con_id, username;
EXIT
"@ | & $sqlplus -S / as sysdba

Services and the listener

Two Windows services run the database. Both start automatically:

Get-Service OracleServiceORCL, OracleOraDB19Home1TNSListener | Select-Object Name, Status, StartType
Get-CimInstance Win32_Service -Filter "Name='OracleServiceORCL'" | Select-Object Name, StartName

The listener answers on the loopback address only:

Get-NetTCPConnection -State Listen -LocalPort 1521 | Select-Object LocalAddress, LocalPort, OwningProcess
& 'C:\app\oracle\product\19.0.0\dbhome_1\bin\lsnrctl.exe' status | Select-String 'Connecting to|DESCRIPTION|Service "'

To stop and start the database cleanly, use the services (stop the database before the listener):

Stop-Service OracleServiceORCL
Start-Service OracleServiceORCL

Connect from your workstation

The listener is loopback-only, so the safest way to use a client on your workstation (SQL Developer, SQLcl, an application) is AWS Systems Manager Session Manager port forwarding, which needs no inbound port at all. With the instance profile from the launch step and the Session Manager plugin installed on your workstation:

aws ssm start-session --region <region> --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters portNumber=1521,localPortNumber=1521

Leave it running and connect your client to localhost:1521, service ORCLPDB1.

Accept direct client connections

If your applications must connect directly, encrypt the connections first, then open the port to your own networks only:

1. Require Oracle native network encryption. Add these lines to C:\app\oracle\product\19.0.0\dbhome_1\network\admin\sqlnet.ora:

text SQLNET.ENCRYPTION_SERVER = REQUIRED SQLNET.ENCRYPTION_TYPES_SERVER = (AES256) SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

or configure TLS (TCPS) with a wallet as Oracle's Database Security Guide describes. 2. Bind the listener to the instance's private address as well: in listener.ora (same folder) add (ADDRESS = (PROTOCOL = TCP)(HOST = <private-ip>)(PORT = 1521)) next to the 127.0.0.1 address, then restart the listener service (Restart-Service OracleOraDB19Home1TNSListener) and run ALTER SYSTEM SET LOCAL_LISTENER='(ADDRESS=(PROTOCOL=TCP)(HOST=<private-ip>)(PORT=1521))' SCOPE=BOTH; as SYSDBA. 3. Allow 1521 in the Windows Firewall from your application network only:

powershell New-NetFirewallRule -DisplayName 'Oracle 1521 from app subnet' -Direction Inbound -Protocol TCP -LocalPort 1521 -RemoteAddress 10.0.0.0/16 -Action Allow

1. Add the same source range for TCP 1521 to the instance's security group. Never open 1521 to 0.0.0.0/0.

Change the passwords

Connect as SYSDBA (sqlplus / as sysdba on the instance) and change a password with ALTER USER system IDENTIFIED BY "<new password>";, or use SQL*Plus's PASSWORD command, which prompts without echoing. The server accepts only Oracle 12c password verifiers (SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12a), so use an Oracle 12.1.0.2 or newer client. After a change, update or delete oracle-db-credentials.txt.

Metadata service block

Every Oracle program is blocked from the instance metadata service by outbound Windows Firewall rules. List them:

Get-NetFirewallRule -Group 'cloudimg metadata block' |
  Select-Object DisplayName, Enabled, Direction, Action | Sort-Object DisplayName

The rules apply to the Oracle programs only. Windows, EC2Launch v2 and the SSM agent keep their metadata access, and they all use IMDSv2 (a request without a session token is refused).

View the baseline report

Everything the build measured ships in C:\ProgramData\cloudimg\baseline\:

Get-Content C:\ProgramData\cloudimg\baseline\baseline-summary.json | ConvertFrom-Json |
  Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

HardeningKitty ships no Microsoft finding list for Windows Server 2019. The list used here, finding_list_cloudimg_msft_ws2019_member_machine.csv, is generated from the rules file Microsoft publishes inside the Windows Server 2019 baseline (MSFT-WS2019-MemberServer-FINAL.PolicyRules), so each rule is scored against Microsoft's own value for Windows Server 2019.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image. Run it in an elevated PowerShell; it only reads settings and takes a minute or two:

$hk = 'C:\ProgramData\cloudimg\tools\HardeningKitty-0.9.4'
Import-Module "$hk\HardeningKitty.psm1" -Force
$list = "$hk\lists\finding_list_cloudimg_msft_ws2019_member_machine.csv"
$csv = Join-Path $env:TEMP 'hardeningkitty-now.csv'
Remove-Item $csv -ErrorAction SilentlyContinue
$null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1
$waived = (Get-Content -Raw C:\ProgramData\cloudimg\baseline\waivers.json | ConvertFrom-Json).waivers.id
$scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID })
$pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count
"{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count)
$scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules are set differently on purpose. Each one is in waivers.txt with its reason:

Windows Firewall

Every firewall profile is on with inbound traffic blocked unless a rule allows it. The only inbound rules enabled are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP):

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
  Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Patching

Windows is fully patched when the image is built. Check for newer updates with:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher()
$searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

and install them from Settings, Windows Update (or sconfig option 6). Stop OracleServiceORCL before a restart that Windows asks for.

Oracle Database is the 19.3.0.0.0 base release. Oracle's Release Updates are available only to customers with Oracle support, so cloudimg does not apply them. Apply the current Release Update with your own My Oracle Support entitlement, following Oracle's Database Installation Guide for Microsoft Windows and the Release Update's readme (OPatch from the Oracle home, then datapatch in each container). Check the patch level with:

$sqlplus = 'C:\app\oracle\product\19.0.0\dbhome_1\bin\sqlplus.exe'
@"
SET PAGESIZE 50 LINESIZE 150
SELECT version_full FROM v`$instance;
EXIT
"@ | & $sqlplus -S / as sysdba

Backups

Take database-consistent backups with RMAN (Recovery Manager) to the fast recovery area C:\app\oracle\fast_recovery_area (10 GiB, sized for a starting database) or to another volume, and copy them off the instance, for example to Amazon S3. EBS snapshots of a running database are crash-consistent only. ARCHIVELOG mode is off by default; turn it on before you rely on point-in-time recovery.

Oracle VSS Writer

The Oracle VSS Writer service (OracleVssWriterORCL, for Windows Volume Shadow Copy backups of the database) is installed but disabled. It needs the Back up files and directories right, which the Microsoft Security Baseline grants to Administrators only, so cloudimg keeps the baseline. If you use a VSS-based backup product, grant the right to NT SERVICE\OracleVssWriterORCL (Local Security Policy, User Rights Assignment), set the service to Automatic and start it. Note that this is a deviation from the baseline: HardeningKitty rule 10305 then reports it, and the local policy refresh can take the right back unless you also change the local Group Policy.

Licensing

This image includes no Oracle licence. You must hold Oracle Database Enterprise Edition licences covering the instance under Oracle's Licensing Oracle Software in the Cloud Computing Environment policy: on AWS, two vCPUs count as one processor licence when hyper-threading is enabled. Database options and management packs (Partitioning, Advanced Security, the Diagnostics and Tuning Packs and others) need their own Oracle licences; do not use them without one. The Windows Server licence is included in the EC2 charge.

Support

cloudimg provides 24/7 technical support for this image by email and live chat: support@cloudimg.co.uk. Oracle licensing questions go to Oracle; Windows Server licensing questions go to AWS and Microsoft.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Microsoft and Windows Server are trademarks of the Microsoft group of companies. cloudimg is not affiliated with or endorsed by Oracle or Microsoft.