Home / OCI

OCIChecklistIntermediate

Autonomous Database (serverless) secure baseline: private endpoint, mTLS, users and backups

Settings that make an Autonomous Database production-ready on day one, covering network access, wallet vs TLS, admin and application users, auto scaling, backup retention and maintenance.

Deepak Bhardwaj2 min read

Applies toOracle Autonomous Database Serverless (ATP and ADW)

Network access

  • Private endpoint in a private subnet with an NSG (only app subnets on 1521/1522), or at minimum an access control list of allowed IPs/VCNs.
  • Public access disabled for production.

Connections

  • Decide mTLS (wallet) or TLS (walletless). TLS needs an ACL or private endpoint; it simplifies JDBC thin and .NET connections.
  • Choose the right service name: _tp/_tpurgent for OLTP, _low/_medium/_high for reporting and batch (different concurrency and parallelism).
  • Wallets rotated when staff leave (wallet rotation invalidates old wallets).
oci db autonomous-database update --autonomous-database-id <adb-ocid> --is-mtls-connection-required false

Users

  • ADMIN used only for administration; password in Vault, rotated.
  • Application schemas with least privilege; no DBA role for apps.
  • Database users authenticated through OCI IAM or Entra ID where possible (no shared passwords).
  • Password profile set (expiry/lockout) for human users only; service accounts get a profile without expiry (see the ORA-28000 post).

Capacity

  • Base ECPUs from measurement; compute auto scaling on (up to 3× base) for spikes.
  • Storage auto scaling on if growth is unpredictable.

Backups

  • Automatic backups are on by default; set retention (1–60 days) to match the RPO/PITR window agreed with the customer.
  • Long-term backups (monthly/yearly) for compliance.
  • Clone from backup tested (point-in-time clone to a new database).
oci db autonomous-database create-from-backup-timestamp --autonomous-database-id <source-adb-ocid> \
  --timestamp 2026-10-22T08:00:00.000Z --clone-type FULL --compartment-id <cmp> \
  --db-name SALESPITR --admin-password '<from-vault>'
# or console: More actions → Create clone → Clone from a backup

Maintenance and patching

  • Patch level (Regular or Early) chosen; customer contacts set for maintenance notifications.
  • Apps use retry logic: patching is rolling but sessions can be moved.
  • Application Continuity / Transparent Application Continuity enabled on the service if the app uses compatible drivers.

Monitoring

  • Performance Hub reviewed after go-live.
  • Alarms: CPU utilization, storage utilization, failed connections, current logons.
  • Events for backup failures and maintenance start/end.

HA notes

Autonomous Database Serverless already runs on Exadata infrastructure with redundancy inside the AD. For zone/AD and region protection, enable Autonomous Data Guard (local and/or cross-region standby), covered in the OCI HA and DR posts.

Related fixes