1. Copy the OCID of the compartment containing your Key Store resource.

   You can find this OCID on the Compartment Details page of the compartment.

2. Create a dynamic group by following the instructions in "To create a dynamic group" in Oracle Cloud Infrastructure Documentation. When following these instructions, enter a matching rule of this format:

   ALL {resource.compartment.id ='<compartment-ocid>'}

   where <compartment-ocid> is the OCID of the compartment containing your Key Store resource.

3. After creating the dynamic group, navigate to (or create) an IAM policy in a compartment higher up in your compartment hierarchy than the compartment containing your vaults and secrets. Then, add a policy statement of this format:

   allow dynamic-group <dynamic-group> to use secret-family in compartment <vaults-and-secrets-compartment>

   where <dynamic-group> is the name of the dynamic group you created and <vaults-and-secrets-compartment> is the name of the compartment in which you created your vaults and secrets.

1. Copy the OCID of the compartment containing your Exadata infrastructure resource.
   You can find this OCID on the Compartment Details page of the compartment.
2. Create a dynamic group by following the instructions in "To create a dynamic group" in Oracle Cloud Infrastructure Documentation. When following these instructions, enter a matching rule of this format:

   ALL {resource.compartment.id ='<compartment-ocid>'}

   where <compartment-ocid> is the OCID of the compartment containing your Exadata infrastructure resource.

3. After creating the dynamic group, navigate to (or create) an IAM policy in a compartment higher up in your compartment hierarchy than the compartment containing your Key Store. Then, add a policy statement of this format:

   Allow dynamic-group <dynamic-group> to use keystores in compartment <key-store-compartment>

   where <dynamic-group> is the name of the dynamic group you created and <key-store-compartment> is the name of the compartment in which you created your Key Store.

1. Open the navigation menu. Under Oracle Database, click Exadata Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.

   Key Stores page displays the list name of key stores, the number of databases associated with each database, and the date on which each key store was created.

4. Click Create Key Store.
5. In the Create Key Store dialog, enter the following general information:
   • Name your key store: A user-friendly description or other information that helps you easily identify the Key Store resource. Avoid entering confidential information.
   • Oracle Key Vault connection settings
     • Connection IP addresses: Enter at least one OKV cluster node IP address; multiple comma-separated IP addresses (of the same OKV cluster) are possible, for example, 193.10.20.1, 193.10.20.2.
     • Administrator username: Enter the user name of the okv_rest_user.
     • Administrator Password Secret: The administrator password is stored with the secret management service within OCI. Select the OCI Vault in your tenancy that contains okv_rest_user password stored as Secret.
   • Tags: Optionally, you can apply tags. If you have permission to create a resource, you also have permission to apply free-form tags to that resource. To apply a defined tag, you must have permission to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure if you should apply tags, skip this option (you can apply tags later) or ask your administrator. Avoid entering confidential information.
6. Click Create Key Store.
7. Ensure that you use the same "okv_rest_user" user credentials, while provisioning Autonomous Database.

   For more information, see Managing Vaults, Managing Keys, and Managing Secrets.

Follow these steps to view Key Store details that include Oracle Key Vault (OKV) connection details and the list of associated databases.

1. Open the navigation menu. Under Oracle Database, click Exadata Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.

   Key Stores page displays the list name of Key Stores, the number of databases associated with each database, and the date on which each Key Store was created.

4. Click the name of the Key Store or click the Actions icon (three dots), and then click View Details.
5. Click the link in the Administrator Password Secret field to view secret details.

You can edit a Key Store only if it is not associated with any CDBs.

1. Open the navigation menu. Under Oracle Database, click Exadata Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.
4. Click the name of the Key Store or click the Actions icon (three dots), and then click View Details.
5. On the Key Store Details page, click Edit.
6. On the Edit Key Store page, make changes as needed, and then click Save Changes.

Follow these steps to move a Key Store on an Oracle Exadata Cloud@Customer system from one compartment to another compartment.

1. Open the navigation menu. Under Oracle Database, click Exadata Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.
4. Click the name of the Key Store or click the Actions icon (three dots), and then click View Details.
5. On the Key Store Details page, click Move Resource.
6. On the Move Resource to a Different Compartment page, select the new compartment.
7. Click Move Resource.

You can delete a Key Store only if it is not associated with any CDBs.

1. Open the navigation menu. Under Oracle Database, click Exadata Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.
4. Click the name of the Key Store or click the Actions icon (three dots), and then click View Details.
5. On the Key Store Details page, click Delete.
6. On the Delete Key Store dialog, click Delete.

Follow these steps to view details of the container database associated with a Key Store.

1. Open the navigation menu. Under Oracle Database, click Exadata Database Service on Cloud@Customer.
2. Choose your Compartment.
3. Click Key Stores.
4. In the resulting Key Stores page, click the name of the Key Store or click the Actions icon (three dots), and then click View Details.
5. Click the name of the associated database or click the Actions icon (three dots), and then click View Details.

Learn how to use the API to manage key store.

For information about using the API and signing requests, see "REST APIs" and "Security Credentials". For information about SDKs, see "Software Development Kits and Command Line Interface".

The following table lists the REST API endpoints to manage key store.