1. Create a vault in the Vault service by following the instructions in To create a new vault in Oracle Cloud Infrastructure Documentation. When following these instructions, Oracle recommends that you create the vault in a compartment created specifically to contain the vaults containing customer-managed keys, as described in Compartment Hierarchy Best Practice.
   After creating the vault, you can create at least one master encryption key in the vault by following the instructions in To create a new master encryption key in Oracle Cloud Infrastructure Documentation. You can also import a customer encryption key into an existing vault. When following these instructions, make these choices:

   • Create in Compartment: Oracle recommends that you create the master encryption key in the same compartment as its vault; that is, the compartment created specifically to contain the vaults containing customer-managed keys.
   • Protection Mode: Choose an appropriate value from the drop-down list:
     • HSM to create a master encryption key that is stored and processed on a hardware security module (HSM).
     • Software to create a master encryption key that is stored in a software file system in the Vault service. Software-protected keys are protected at rest using an HSM-based root key. You may export software keys to other key management devices or to a different OCI cloud region. Unlike HSM keys, software-protected keys are free of cost.
   • Key Shape Algorithm: AES
   • Key Shape Length: 256 bits
   • Import External Key: To use a customer encryption key (BYOK), select Import External Key and provide the following details:
     • Wrapping Key Information. This section is read-only, but you can view the public wrapping key details.
     • Wrapping Algorithm. Select a wrapping algorithm from the drop-down list.
     • External Key Data Source. Upload the file that contains the wrapped RSA key material.

   Note
   
   You can either import the key material as a new external key version or click the name of an existing master encryption key and rotate it to a new key version.

   Refer to Importing Key Material as an External Key Version for more details.

2. Use the Networking service to Create a Service Gateway, a Route Rule and an Egress Security Rule to the VCN (Virtual Cloud Network) and subnets where your Autonomous Database resources reside.
3. Use the IAM service to Create a Dynamic Group identifying your Autonomous Database resources and a policy statement granting that dynamic group access to the master encryption keys you created.

1. Go to the Subnet Details page for the subnet.
2. In the Subnet Information tab, click the name of the subnet's Route Table to display its Route Table Details page.
3. In the table of existing Route Rules, check whether there is already a rule with the following characteristics:
   • Destination: All IAD Services In Oracle Services Network
   • Target Type: Service Gateway
   • Target: The name of the service gateway you just created in the VCN

   If such a rule does not exist, click Add Route Rules and add a route rule with these characteristics.

4. Return to the Subnet Details page for the subnet.
5. In the subnet's Security Lists table, click the name of the subnet's security list to display its Security List Details page.
6. In the side menu, under Resources, click Egress Rules.
7. In the table of existing Egress Rules, check whether there is already a rule with the following characteristics:
   • Stateless: No
   • Destination: All IAD Services In Oracle Services Network
   • IP Protocol: TCP
   • Source Port Range: All
   • Destination Port Range: 443

   If such a rule does not exist, click Add Egress Rules and add an egress rule with these characteristics.

1. Copy the OCID of the compartment containing your Exadata Infrastructure resource. You can find this OCID on the Compartment Details page of the compartment.
2. Create a dynamic group by following the instructions in To create a dynamic group in Oracle Cloud Infrastructure Documentation. When following these instructions, enter a matching rule of this format:

   ALL {resource.compartment.id ='<compartment-ocid>'}

   where <compartment-ocid> is the OCID of the compartment containing your Autonomous Exadata VM Cluster resource.

allow dynamic-group <dynamic-group-name>
to manage keys
in compartment <vaults-and-keys-compartment>
where all {
target.key.id='<key_ocid>',
request.permission!='KEY_MOVE',
request.permission!='KEY_IMPORT'
}

allow dynamic-group <dynamic-group>
to read vaults
in tenancy | compartment <vaults-and-keys-compartment>