Oracle Database on AWS User Guide

Overview

This Marketplace listing is a single product that ships eight Oracle Database delivery options. The 19c and 21c variants run on Oracle Linux 8; the 26ai variants run on Oracle Linux 9. You pick the one that matches your licensing and architecture when you launch. Each variant has its own focused deployment guide — choose your variant in the table below and open it.

Every variant is secure by default: the database listener accepts connections on 127.0.0.1 only, the default security group opens port 22 only, and each instance gets its own random database passwords on first boot, before the database is reachable. You connect tools such as SQL Developer through an SSH tunnel, or open port 1521 deliberately to your own network following your variant's guide.

Select Your Variant

Each guide covers launch from the Marketplace and the AWS CLI, SSH access, the per-instance credentials and the security self-test, connecting with SQL*Plus and with SQL Developer over an SSH tunnel, opening port 1521 deliberately with network encryption, service management, storage layout and backup — specific to that variant.

• Oracle Database 19c SE2 → — Long Term Support, Standard Edition 2, single non-container database on a filesystem volume.
• Oracle Database 19c EE → — Long Term Support, Enterprise Edition with the full option catalogue (Partitioning, Advanced Compression, TDE, Data Guard).
• Oracle Database 21c SE2 → — Innovation Release, Standard Edition 2, multitenant container database (CDB ORCL with pluggable database ORCLPDB).
• Oracle Database 21c EE → — Innovation Release, Enterprise Edition, multitenant with the full option catalogue.
• Oracle Database 19c EE with ASM → — Enterprise Edition on Automatic Storage Management via Grid Infrastructure / Oracle Restart (+DATA and +RECO disk groups).
• Oracle Database 21c EE with ASM → — Innovation Release, Enterprise Edition, multitenant on ASM with Grid Infrastructure.
• Oracle Database 26ai EE → — the AI Database (23ai Long Term Support family), Enterprise Edition with the full option catalogue, multitenant container database (CDB ORCL with pluggable database ORCLPDB) on a filesystem volume, running on Oracle Linux 9. (Oracle 23ai/26ai has no Standard Edition 2 — the SE2 variants are 19c and 21c.)
• Oracle Database 26ai EE with ASM → — the AI Database (23ai Long Term Support family), Enterprise Edition, multitenant on Automatic Storage Management via Grid Infrastructure / Oracle Restart (+DATA and +RECO disk groups), running on Oracle Linux 9.

Which Variant Should I Choose?

Release — 19c vs 21c vs 26ai. Oracle Database 19c is the Long Term Support release, covered by Oracle Extended Support through April 2027, and is the recommended target for new production deployments that do not yet need the 23ai feature set. It is a traditional non-container (non-CDB) database named ORCL. Oracle Database 21c is an Innovation Release — where Oracle first shipped blockchain tables, native JSON, immutable tables and in-database JavaScript — and is multitenant only: the database is always a container database (CDB) named ORCL with a pluggable database (PDB) named ORCLPDB inside it, and your applications connect to the ORCLPDB service. Oracle Database 26ai is the AI Database release in the 23ai Long Term Support family, bringing AI-driven capabilities (such as AI Vector Search) alongside the proven relational engine; like 21c it is multitenant only (CDB ORCL with PDB ORCLPDB) and, in this listing, runs on Oracle Linux 9.

Edition — SE2 vs EE. Standard Edition 2 provides the core relational engine within the SE2 licensing envelope of two sockets and sixteen user threads — suitable for line-of-business systems, application back ends and development databases. Enterprise Edition has no socket cap and unlocks the full option catalogue: Partitioning, Advanced Compression, Advanced Security (TDE), the Diagnostics and Tuning Packs, Data Guard and more.

Storage — Filesystem vs ASM. The filesystem variants keep the Oracle home and datafiles on a single dedicated 30 GiB gp3 EBS volume at /opt/oracle — the simplest layout. The ASM variants put the datafiles on Oracle Automatic Storage Management through single-instance Grid Infrastructure (Oracle Restart) — two raw EBS volumes form the +DATA and +RECO disk groups, with the Oracle homes on a separate 50 GiB /u01 volume. ASM gives you operational parity with on-premises Oracle estates (the same asmcmd and srvctl tooling and disk-group model), multi-volume IOPS aggregation and online storage management. The ASM variants are Enterprise Edition only.

What Every Variant Has in Common

Whichever variant you launch, the image shares the same operational shape, so the launch and access steps are the same:

• Oracle Linux base image — Oracle Linux 8 for the 19c and 21c variants, Oracle Linux 9 for the 26ai variants — with the SQL*Plus client in the Oracle home.
• No shared credentials — on the first boot of every instance a one-shot firstboot service runs before the database is reachable: with no listener running, it sets a unique random 24-character password on SYS and SYSTEM, on PDBADMIN for the multitenant (CDB) variants, and on the ASM administrator SYS@+ASM and ASMSNMP for the ASM variants. Every other password account is re-keyed with a random value and left locked and expired. Only then does it start the listener, prove each new password works and each historic or default one is refused, and write the passwords to /root/oracle-db-credentials.txt with mode 0600 so only root can read them. Two instances launched from the same image never share credentials. First boot takes a few minutes, and if it cannot complete it stops the database on purpose and explains why in /root/oracle-db-FIRSTBOOT-FAILED.txt.
• Security self-test — run sudo /usr/local/sbin/cloudimg-oracle-selftest on the instance at any time; it re-proves these guarantees, prints a PASS line per check and ends with SELFTEST_OK.
• Listener on 127.0.0.1:1521 only, and a default security group that opens port 22 only. Connect SQL Developer and JDBC clients through an SSH tunnel, or, if you need direct network access, open port 1521 deliberately to your own network with network encryption required — your variant's guide has the steps. Never open port 1521 to the whole internet.
• Recommended instance type m5.large (8 GiB). The starter database is sized for it; use m5.xlarge or larger for production and raise the memory targets as your variant's guide describes. Oracle licenses Standard Edition 2 on AWS only up to 8 vCPUs; Enterprise Edition has no such cap.
• cloudimg 24/7/365 support with a guaranteed 24-hour response and one-hour average for critical issues.

The detailed launch, connection, management and storage steps — which differ by release, edition and storage type — are in each variant's own guide linked above.

Instances launched from earlier images. Instances launched from images published before October 2026 ran the listener on all interfaces (0.0.0.0:1521), and the security group created by default with those images opened port 1521 to the internet; on the multitenant variants the PDBADMIN account also kept its build-time password. If you run such an instance, remove the world-open port 1521 rule from its security group, bind the listener back to 127.0.0.1 and restart it, and set a new PDBADMIN password. Your variant's guide has the exact steps.

Prerequisites

Before you deploy any variant you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network. Port 1521 does not need to be open: you reach the database through an SSH tunnel
• An SSH client on your workstation, which also provides the tunnel for SQL Developer and JDBC
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Support

cloudimg provides 24/7/365 expert technical support for these images. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk.

For general Oracle Database and ASM questions, performance tuning and migration help, consult the official Oracle documentation: the Oracle Database 19c, 21c and 23ai documentation sets and the Oracle Automatic Storage Management Administrator's Guide.

Oracle, Oracle Database, Oracle ASM, and related marks are trademarks or registered trademarks of Oracle Corporation. Use of them does not imply any affiliation with or endorsement by Oracle Corporation.