Databases AWS

Oracle Database 26ai Enterprise Edition on AWS User Guide

Last updated: 2026-06-06 | Product: Oracle Database 26ai Enterprise Edition on AWS

Overview

This image runs Oracle Database 26ai Enterprise Edition, installed from upstream Oracle media on Oracle Linux 9. Oracle Database is the only workload on the image, so the platform stays lean, predictable and easy to reason about. The image ships the 23.26.0.0.0 base release. Oracle Database 26ai is the AI Database release in the 23ai Long Term Support family.

Oracle Database 26ai uses the multitenant architecture and desupports the traditional non container architecture, so the starter database is a multitenant container database (CDB) named ORCL with one ready to use pluggable database (PDB) named ORCLPDB. Applications connect to the ORCLPDB service; the ORCL container root is used for administration. You can create additional pluggable databases in this container as your estate grows — up to three without the separately licensed Multitenant option, and more with it.

The image ships with no shared or default database credentials. On the first boot of your instance a one shot service runs before the database is reachable over the network: with no listener running, it sets a unique random 24 character password on the SYS, SYSTEM and PDBADMIN accounts, re-keys every other password account with a random value and leaves it locked and expired, and only then starts the listener. It proves each new password works and each historic or default one is refused, and writes the passwords to /root/oracle-db-credentials.txt, a file that only the root user can read.

The Oracle binaries, the datafiles, the redo logs and the archive area live on a dedicated storage volume mounted at /opt/oracle. Keeping the database tier on its own volume means storage can be grown, snapshotted and backed up independently of the operating system disk. The Oracle listener runs on port 1521 bound to 127.0.0.1 only, and the default security group opens port 22 only, so the database is never exposed to the network when the instance starts. SQL Developer and JDBC clients reach it through an SSH tunnel; if you need direct network access, the section Opening Port 1521 Deliberately shows how to open it to your own network with encryption turned on.

This is a headless image. Oracle Database has no web interface in this listing; you administer it over SSH with the sqlplus command line client, and you can connect graphical tools such as Oracle SQL Developer through an SSH tunnel.

Enterprise Edition is the full-featured Oracle Database edition. It has no socket cap and includes the complete option catalogue — Partitioning, Advanced Compression, Advanced Security with Transparent Data Encryption, Data Guard for high availability and disaster recovery, and the Diagnostics and Tuning Packs — for demanding, large-scale and high-availability workloads. Note that Oracle Database 23ai and 26ai do not offer Standard Edition 2; the SE2 variants on this listing are 19c and 21c.

Prerequisites

Before you deploy this image you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network. Port 1521 does not need to be open: you reach the database through an SSH tunnel
An SSH client on your workstation, which also provides the tunnel for SQL Developer and JDBC
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Recommended instance type: m5.large (2 vCPU, 8 GiB RAM). The starter database is sized for it: dbca automatic shared memory management with 3072 MB in total, about 2.3 GiB of System Global Area (sga_target) and about 768 MiB of pga_aggregate_target, leaving room for the operating system. For production workloads use m5.xlarge or larger and raise the memory targets as described in Sizing Memory for Production.

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Oracle Database. Select the cloudimg listing and choose Select, then Continue on the subscription summary. On the configuration page choose the Oracle Database 26ai EE on Oracle Linux 9 version.

Pick the recommended instance type m5.large, or m5.xlarge or larger for production. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network only. Do not open port 1521: the listener accepts connections on 127.0.0.1 only, and you reach it through an SSH tunnel. Leave the root volume at the default size or larger; the Oracle data volume is attached automatically from the image.

Select Launch instance. First boot initialisation sets and verifies the per instance passwords before the database is reachable, so it takes a few minutes after the instance state becomes Running and the status checks pass, a little longer than a plain database start.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg Oracle Database Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22 from your management network only.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-db-26ai-ee-01}]'

The command prints a JSON document on success. Note the instance ID, then retrieve its public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Step 3: Connect over SSH

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user for this AMI variant is ec2-user:

AMI variant	SSH login user
Oracle Database 26ai EE on Oracle Linux 9	`ec2-user`

ssh -i <your-key.pem> ec2-user@<public-ip>

Wait until the instance has passed both EC2 status checks before connecting. SSH can become available while the first boot service is still setting the passwords; first boot is complete once the ready marker exists:

test -f /var/lib/cloudimg/oracle-db-26ai-firstboot.done && echo "first boot complete"

The command prints first boot complete. If it prints nothing, wait a minute and run it again. The database service oracle-db.service only starts after the marker is written.

Step 4: Retrieve the Generated Credentials

The first boot service generates fresh SYS, SYSTEM and PDBADMIN passwords for this instance and writes them, with the connection details, to /root/oracle-db-credentials.txt. The file is mode 0600 and owned by root, so only the root user can read it. Display it from your SSH session:

sudo cat /root/oracle-db-credentials.txt

The file looks like this, with unique passwords on your instance:

# Oracle Database 26ai Enterprise Edition - per-instance credentials (cloudimg)
# Generated Sat Oct 17 11:12:04 UTC 2026 on i-0123456789abcdef0. Root-only (0600). Unique to this instance.

SYS_PASSWORD=Example0nlyNotARealPass0
SYSTEM_PASSWORD=Example0nlyNotARealPass1
PDBADMIN_PASSWORD=Example0nlyNotARealPass2

ORACLE_SID=ORCL
PDB_SERVICE=ORCLPDB
LISTENER=127.0.0.1:1521 (localhost only - use an SSH tunnel, or see the guide to open it deliberately with encryption)

Every other database account is locked and expired with a random password.
Connect: sudo su - oracle ; . ~/setEnv.sh ; sqlplus /nolog ; then CONNECT system@//localhost:1521/ORCLPDB

The passwords above are fake samples; your file holds unique random values. Each line is in KEY=value form. To read a single value into a shell variable, for example in a script, use an extraction that also copes with older files written as KEY= value:

sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt

No shared or default database passwords ship in the image. Use the generated SYSTEM password for application and administrative connections, the SYS password for SYSDBA operations, and the PDBADMIN password for the local administrator of the ORCLPDB pluggable database.

Every other password account in the database, such as DBSNMP and the other Oracle supplied accounts, has been given a random password nobody knows and is locked and expired. To use one of them, set your own password and unlock it as SYSDBA, connected to the container that holds the account (for a common account, connect to the ORCL root and add CONTAINER=ALL):

ALTER USER <name> IDENTIFIED BY "<new-password>" ACCOUNT UNLOCK;

If the credentials file is missing, first boot has not finished or did not complete. See If First Boot Does Not Complete below.

Step 5: Confirm the Database Service and the Listener

Oracle Database starts automatically on boot through the oracle-db.service systemd unit, which runs Oracle's dbstart to open the database and start the listener. The unit only starts once first boot has written its ready marker. Confirm the unit is enabled for automatic start at boot:

systemctl is-enabled oracle-db.service

The command prints enabled. A companion one shot unit, oracle-db-26ai-firstboot.service, performs the per instance credential rotation on the first boot; confirm it is enabled too:

systemctl is-enabled oracle-db-26ai-firstboot.service

Confirm the Oracle listener is accepting connections. It binds to the loopback address 127.0.0.1 on port 1521 only, so it is reachable from the instance itself and through an SSH tunnel, but not directly from the network:

ss -tln | grep '127.0.0.1:1521 '

You should see a single listening socket on 127.0.0.1:1521. Run lsnrctl status as the oracle user for the full listing, which shows the listening endpoint (HOST=127.0.0.1)(PORT=1521) with the ORCL container and ORCLPDB pluggable database services registered and ready.

The image includes a security self test that re-proves the first boot guarantees on your running instance: the ready marker is present, the credentials file is root only, each per instance password is accepted and each historic or default password is refused, every other password account is locked, no plaintext password is visible in the audit trail, the listener is bound to 127.0.0.1 only and the memory settings fit the instance. Run it at any time:

sudo /usr/local/sbin/cloudimg-oracle-selftest

The self test prints one PASS: line per check, for example:

PASS: ready marker present
PASS: no first-boot error notice
PASS: /root/oracle-db-credentials.txt is 0600 root:root
PASS: SYSTEM@ORCL accepts its per-instance password
PASS: PDBADMIN@ORCLPDB accepts its per-instance password
PASS: every other password account is locked
PASS: listener.ora binds 127.0.0.1 only
PASS: no database socket on a non-loopback address
SELFTEST_OK

The last line is SELFTEST_OK when every check passes. If you later open port 1521 deliberately, the two listener checks report that change, which is expected.

Step 6: Confirm the Edition and Version

The database runs as the oracle operating system user, whose login environment sets ORACLE_HOME, ORACLE_SID and the library path. Connect to the container root with operating system authentication and query the version views. The following block reports the product banner, which names the edition, and the instance name, full version and open status:

sudo su - oracle -c 'sqlplus -S -L / as sysdba' <<'SQL'
SET PAGESIZE 50 LINESIZE 120 FEEDBACK OFF
SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';
SELECT instance_name, version_full, status FROM v$instance;
EXIT;
SQL

The banner names Oracle Database 26ai Enterprise Edition, and the instance ORCL reports a 23.26.0.0.0 full version with status OPEN. You can confirm the client version at any time with sqlplus -V.

Step 7: The Container Database and the Pluggable Database

Oracle Database 26ai uses the multitenant architecture. The container database ORCL holds one pluggable database, ORCLPDB, which is where your application schemas and data live. Confirm the pluggable database is open in read write mode:

sudo su - oracle -c 'sqlplus -S -L / as sysdba' <<'SQL'
SET PAGESIZE 50 LINESIZE 120 FEEDBACK OFF
COLUMN name FORMAT a12
COLUMN open_mode FORMAT a12
SELECT name, open_mode FROM v$pdbs WHERE name = 'ORCLPDB';
SELECT sysdate AS server_time FROM dual;
EXIT;
SQL

ORCLPDB reports READ WRITE. The pluggable database is configured with saved state, so it opens automatically whenever the container database starts.

Step 8: Connect with SQL*Plus

To run application workloads, connect to the ORCLPDB pluggable database service as the SYSTEM user with the generated password. Switch to the oracle user and source the environment first, then open SQL*Plus. Replace <SYSTEM_PASSWORD> with the value from /root/oracle-db-credentials.txt:

sudo su - oracle
. ~/setEnv.sh
sqlplus system/<SYSTEM_PASSWORD>@localhost:1521/ORCLPDB

Inside SQL*Plus you can create application schemas, tables and data in the pluggable database. The following statements, run at the SQL> prompt, create a table, insert a row and read it back:

CREATE TABLE products (
  id    NUMBER GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  name  VARCHAR2(100),
  price NUMBER(10,2)
);

INSERT INTO products (name, price) VALUES ('Mechanical Keyboard', 89.00);
COMMIT;

SELECT name, price FROM products;

Type EXIT to leave SQL*Plus. To connect to the container root for administration instead, use operating system authentication with sqlplus / as sysdba, or connect as SYS with sqlplus sys/<SYS_PASSWORD>@localhost:1521/ORCL as sysdba. The pluggable database's local administrator connects with sqlplus pdbadmin/<PDBADMIN_PASSWORD>@localhost:1521/ORCLPDB.

Step 9: Connect Remotely with SQL Developer or JDBC

The listener accepts connections on 127.0.0.1 only, so remote tools reach it through an SSH tunnel over port 22, which the security group already allows. On your workstation, open the tunnel and leave it running while you work:

ssh -i <your-key.pem> -N -L 1521:127.0.0.1:1521 ec2-user@<public-ip>

Port 1521 on your workstation now forwards to the listener on the instance. Point Oracle SQL Developer, a JDBC driver or any Oracle client at localhost, using the password from the credentials file:

Host:            localhost
Port:            1521
Service name:    ORCLPDB
Username:        SYSTEM
Password:        <your generated SYSTEM password>

JDBC URL:        jdbc:oracle:thin:@//localhost:1521/ORCLPDB

In SQL Developer, create a new connection, set the Connection Type to Basic, enter localhost, port 1521 and the ORCLPDB service name, supply the SYSTEM username and generated password, and select Test then Connect. For administrative access to the container root, use the ORCL service name and connect as SYS with the SYSDBA role. If port 1521 is already in use on your workstation, forward a different local port, for example -L 1522:127.0.0.1:1521, and connect to localhost:1522.

If application servers need to reach the database directly over the network rather than through a tunnel, see Opening Port 1521 Deliberately below.

Step 10: The Oracle Data Volume

The Oracle binaries, the datafiles, the redo logs and the archive area are stored under /opt/oracle, which is a dedicated EBS volume separate from the operating system disk. Confirm the mount:

findmnt /opt/oracle

The output shows /opt/oracle is its own ext4 filesystem on a separate device. Check the available space at any time with:

df -h /opt/oracle

Because the database tier is on its own volume you can take an Amazon EBS snapshot of it on its own schedule, and you can grow it independently of the root volume.

Step 11: Managing the Database Service

Oracle Database is managed through systemd as the oracle-db.service unit, which starts the database and the listener automatically on boot, as confirmed in step 5. Check the service status:

systemctl status oracle-db.service --no-pager

Stop, start and restart the service when needed. Stopping the service runs Oracle's dbshut to close the database cleanly, and starting it runs dbstart:

sudo systemctl stop oracle-db.service
sudo systemctl start oracle-db.service
sudo systemctl restart oracle-db.service

The Oracle alert log and listener log live under /opt/oracle/diag. Review the alert log first when diagnosing a startup or runtime problem; locate it with:

sudo su - oracle -c 'find /opt/oracle/diag -name alert_ORCL.log'

Step 12: Backups

Oracle Database includes Recovery Manager (RMAN) for consistent, online backups. Run RMAN as the oracle user against the local instance to take a full backup of the container database and its pluggable databases:

sudo su - oracle
. ~/setEnv.sh
rman target / <<'RMAN'
BACKUP DATABASE PLUS ARCHIVELOG;
RMAN

For logical, schema level exports use Oracle Data Pump against the pluggable database:

expdp system/<SYSTEM_PASSWORD>@localhost:1521/ORCLPDB \
  schemas=APPUSER directory=DATA_PUMP_DIR dumpfile=appuser.dmp

Because /opt/oracle is a dedicated EBS volume, you can also take an EBS snapshot of the volume itself for a point in time copy of the entire database tier. For a crash consistent snapshot, place the database in backup mode or shut it down cleanly first.

Opening Port 1521 Deliberately

Only open the listener to the network if a tunnel does not suit your architecture, and only to the private networks that need it. Make all three changes, in this order. Run the first two as the oracle user after sudo su - oracle and . ~/setEnv.sh.

1. Require network encryption. Append the following lines to $ORACLE_HOME/network/admin/sqlnet.ora (the file is created if it does not exist), so that every network session is encrypted and integrity checked:

SQLNET.ENCRYPTION_SERVER = required
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256)
SQLNET.CRYPTO_CHECKSUM_SERVER = required
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

On Oracle Database 26ai, Oracle recommends Transport Layer Security (a TCPS listener endpoint with a wallet) for network encryption; native network encryption, configured above, is deprecated in this release but still works. For TLS, follow the "Configuring Transport Layer Security Encryption" chapter of the Oracle Database Security Guide at https://docs.oracle.com/en/database/oracle/oracle-database/23/dbseg/.

2. Bind the listener to all interfaces. In $ORACLE_HOME/network/admin/listener.ora, change (HOST = 127.0.0.1) to (HOST = 0.0.0.0) on the TCP address line, then restart the listener:

lsnrctl stop
lsnrctl start

3. Allow port 1521 from your own network only. From your workstation, add an inbound rule to the instance's security group for your management or application CIDR:

aws ec2 authorize-security-group-ingress \
  --group-id <security-group-id> \
  --protocol tcp --port 1521 \
  --cidr <your-mgmt-cidr>

Never use 0.0.0.0/0 for port 1521. Clients then connect to the instance's private or public address on port 1521 with the ORCLPDB service name, and their Oracle client negotiates the required encryption automatically.

Sizing Memory for Production

The starter database is sized for the recommended m5.large (8 GiB): a total memory target of 3072 MB, about 2.3 GiB of sga_target and about 768 MiB of pga_aggregate_target. On m5.xlarge (16 GiB) or larger, raise the targets as SYSDBA (sudo su - oracle, . ~/setEnv.sh, sqlplus / as sysdba), adjusting the values to your instance size:

ALTER SYSTEM SET sga_max_size=6G SCOPE=SPFILE;
ALTER SYSTEM SET sga_target=6G SCOPE=SPFILE;
ALTER SYSTEM SET pga_aggregate_target=2G SCOPE=BOTH;

Then restart the database so the new System Global Area takes effect:

sudo systemctl restart oracle-db.service

After resizing, the self test's memory check reports the new values against the m5.large starter sizing, which is expected.

If First Boot Does Not Complete

First boot is fail closed. If any step cannot be completed or proven, the service stops the database and the listener on purpose, writes no credentials file, and leaves an explanation in /root/oracle-db-FIRSTBOOT-FAILED.txt. The instance never accepts database connections until every account has its own random password. To investigate:

sudo cat /root/oracle-db-FIRSTBOOT-FAILED.txt
sudo journalctl -u oracle-db-26ai-firstboot.service -b

Rebooting the instance retries first boot, which runs again until it succeeds. If it fails a second time, contact cloudimg support with the journal output.

Instances Launched from Earlier Images

Instances launched from images published before October 2026 ran the listener on 0.0.0.0:1521, and the security group created by default with those images opened port 1521 to the internet. On those images the PDBADMIN account also kept its build time password. If you run such an instance, make these changes.

Remove the world open rule from the security group, from your workstation:

aws ec2 revoke-security-group-ingress \
  --group-id <security-group-id> \
  --protocol tcp --port 1521 \
  --cidr 0.0.0.0/0

As the oracle user, change (HOST = 0.0.0.0) back to (HOST = 127.0.0.1) in $ORACLE_HOME/network/admin/listener.ora, then restart the listener:

lsnrctl stop
lsnrctl start

Rotate the PDBADMIN password as SYSDBA (sqlplus / as sysdba):

ALTER SESSION SET CONTAINER=ORCLPDB;
ALTER USER PDBADMIN IDENTIFIED BY "<new-strong-password>";

Then reach the database through an SSH tunnel as described in step 9, or open it deliberately as described above. Credentials files on those instances use the KEY= value form; the awk extraction in step 4 reads both forms.

Support

cloudimg provides 24/7/365 expert technical support for this image. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk.

For general Oracle Database administration questions consult the official Oracle Database documentation at https://docs.oracle.com/en/database/oracle/oracle-database/23/.