Oracle DB 26ai EE

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Oracle Database. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary. On the configuration page, choose the Oracle Database 26ai EE on Oracle Linux 9 version.

Pick the recommended instance type m5.large, or m5.xlarge or larger for production. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group that allows inbound port 22 from your management network only. Do not open port 1521. The listener accepts connections on 127.0.0.1 only, and you reach it through an SSH tunnel. Leave the root volume at the default size or larger. The Oracle data volume is attached automatically from the image.

Select Launch instance. First boot initialisation sets and verifies the per-instance passwords before the database is reachable. It takes a few minutes after the instance state becomes Running and the status checks pass, a little longer than a plain database start.

This block launches an instance from the SecureAnyCloud Oracle Database Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens inbound port 22 from your management network only.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-db-26ai-ee-01}]'

The command prints a JSON document on success. Note the instance ID. When the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user for this AMI variant is ec2-user:

AMI variant: Oracle Database 26ai EE on Oracle Linux 9. SSH login user: ec2-user.

ssh -i <your-key.pem> ec2-user@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. SSH can become available while the first boot service is still setting the passwords. First boot is complete once the ready marker exists:

test -f /var/lib/sac/data/oracle-db-26ai-firstboot.done && echo "first boot complete"

The command prints first boot complete. If it prints nothing, wait a minute and run it again. The database service oracle-db.service only starts after the marker is written.

The first boot service generates fresh SYS, SYSTEM and PDBADMIN passwords for this instance and writes them, with the connection details, to /root/oracle-db-credentials.txt. The file is mode 0600 and owned by root, so only the root user can read it. Display it from your SSH session:

sudo cat /root/oracle-db-credentials.txt

The file looks like this, with unique passwords on your instance:

# Oracle Database 26ai Enterprise Edition - per-instance credentials (sac)
# Generated Sat Oct 17 11:12:04 UTC 2026 on i-0123456789abcdef0. Root-only (0600). Unique to this instance. SYS_PASSWORD=<set-at-first-boot> SYSTEM_PASSWORD=<set-at-first-boot> PDBADMIN_PASSWORD=<set-at-first-boot> ORACLE_SID=ORCL PDB_SERVICE=ORCLPDB LISTENER=127.0.0.1:1521 (localhost only - use an SSH tunnel, or see the guide to open it deliberately with encryption) Every other database account is locked and expired with a random password. Connect:
sudo su - oracle ; . ~/setEnv.sh ; sqlplus /nolog ; then CONNECT system@//localhost:1521/ORCLPDB

The passwords above are fake samples; your file holds unique random values. Each line is in KEY=value form. To read a single value into a shell variable, for example in a script, use an extraction that also copes with older files written as KEY= value:

sudo awk -F'= *' '/^SYSTEM_PASSWORD=/{print $2}' /root/oracle-db-credentials.txt

No shared or default database passwords ship in the image. Use the generated SYSTEM password for application and administrative connections, the SYS password for SYSDBA operations, and the PDBADMIN password for the local administrator of the ORCLPDB pluggable database.

Every other password account in the database, such as DBSNMP and the other Oracle-supplied accounts, has been given a random password that nobody knows and is locked and expired. To use one of them, set your own password and unlock it as SYSDBA, connected to the container that holds the account (for a common account, connect to the ORCL root and add CONTAINER=ALL):

ALTER USER <name> IDENTIFIED BY "<new-password>" ACCOUNT UNLOCK;

If the credentials file is missing, first boot has not finished or did not complete. See If first boot does not complete below.

Oracle Database starts automatically on boot through the oracle-db.service systemd unit, which runs Oracle's dbstart to open the database and start the listener. The unit only starts once first boot has written its ready marker. Confirm that the unit is enabled for automatic start at boot:

systemctl is-enabled oracle-db.service

The command prints enabled. A companion one-shot unit, oracle-db-26ai-firstboot.service, performs the per-instance credential rotation on the first boot. Confirm that it is enabled too:

systemctl is-enabled oracle-db-26ai-firstboot.service

Confirm that the Oracle listener is accepting connections. It binds to the loopback address 127.0.0.1 on port 1521 only, so it is reachable from the instance itself and through an SSH tunnel, but not directly from the network:

ss -tln | grep '127.0.0.1:1521 '

You should see a single listening socket on 127.0.0.1:1521. Run lsnrctl status as the oracle user for the full listing, which shows the listening endpoint (HOST=127.0.0.1)(PORT=1521) with the ORCL container and ORCLPDB pluggable database services registered and ready.

The image includes a security self-test that re-proves the first boot guarantees on your running instance. It checks that the ready marker is present, the credentials file is root-only, each per-instance password is accepted and each historic or default password is refused, every other password account is locked, no plaintext password is visible in the audit trail, the listener is bound to 127.0.0.1 only and the memory settings fit the instance. Run it at any time:

sudo /usr/local/sbin/sac-oracle-selftest

The self-test prints one PASS: line per check, for example:

PASS: ready marker present PASS: no first-boot error notice PASS: /root/oracle-db-credentials.txt is 0600 root:root PASS: SYSTEM@ORCL accepts its per-instance password PASS: PDBADMIN@ORCLPDB accepts its per-instance password PASS: every other password account is locked PASS: listener.ora binds 127.0.0.1 only PASS: no database socket on a non-loopback address SELFTEST_OK

The last line is SELFTEST_OK when every check passes. If you later open port 1521 deliberately, the two listener checks report that change, which is expected.

The database runs as the oracle operating system user, whose login environment sets ORACLE_HOME, ORACLE_SID and the library path. Connect to the container root with operating system authentication and query the version views. The following block reports the product banner, which names the edition, and the instance name, full version and open status:

sudo su - oracle -c 'sqlplus -S -L / as sysdba' <<'SQL' SET PAGESIZE 50 LINESIZE 120 FEEDBACK OFF SELECT banner FROM v$version WHERE banner LIKE 'Oracle%'; SELECT instance_name, version_full, status FROM v$instance; EXIT; SQL

The banner names Oracle Database 26ai Enterprise Edition, and the instance ORCL reports a 23.26.0.0.0 full version with status OPEN. You can confirm the client version at any time with sqlplus -V.

Oracle Database 26ai uses the multitenant architecture. The container database ORCL holds one pluggable database, ORCLPDB, which is where your application schemas and data live. Confirm that the pluggable database is open in read-write mode:

sudo su - oracle -c 'sqlplus -S -L / as sysdba' <<'SQL' SET PAGESIZE 50 LINESIZE 120 FEEDBACK OFF COLUMN name FORMAT a12 COLUMN open_mode FORMAT a12 SELECT name, open_mode FROM v$pdbs WHERE name = 'ORCLPDB'; SELECT sysdate AS server_time FROM dual; EXIT; SQL

ORCLPDB reports READ WRITE. The pluggable database is configured with saved state, so it opens automatically whenever the container database starts.

To run application workloads, connect to the ORCLPDB pluggable database service as the SYSTEM user with the generated password. Switch to the oracle user and source the environment first, then open SQL*Plus. Replace <SYSTEM_PASSWORD> with the value from /root/oracle-db-credentials.txt:

sudo su - oracle . ~/setEnv.sh sqlplus system/<SYSTEM_PASSWORD>@localhost:1521/ORCLPDB

Inside SQL*Plus you can create application schemas, tables and data in the pluggable database. The following statements, run at the SQL> prompt, create a table, insert a row and read it back:

CREATE TABLE products ( id NUMBER GENERATED ALWAYS AS IDENTITY PRIMARY KEY, name VARCHAR2(100), price NUMBER(10,2) ); INSERT INTO products (name, price) VALUES ('Mechanical Keyboard', 89.00); COMMIT; SELECT name, price FROM products;

Type EXIT to leave SQL*Plus. To connect to the container root for administration instead, use operating system authentication with sqlplus / as sysdba, or connect as SYS with sqlplus sys/<SYS_PASSWORD>@localhost:1521/ORCL as sysdba. The pluggable database's local administrator connects with sqlplus pdbadmin/<PDBADMIN_PASSWORD>@localhost:1521/ORCLPDB.

The listener accepts connections on 127.0.0.1 only, so remote tools reach it through an SSH tunnel over port 22, which the security group already allows. On your workstation, open the tunnel and leave it running while you work:

ssh -i <your-key.pem> -N -L 1521:127.0.0.1:1521 ec2-user@<public-ip>

Port 1521 on your workstation now forwards to the listener on the instance. Point Oracle SQL Developer, a JDBC driver or any Oracle client at localhost, using the password from the credentials file:

Host: localhost Port: 1521 Service name: ORCLPDB Username: SYSTEM Password: <your generated SYSTEM password> JDBC URL: jdbc:oracle:thin:@//localhost:1521/ORCLPDB

In SQL Developer, create a new connection, set the Connection Type to Basic, enter localhost, port 1521 and the ORCLPDB service name, supply the SYSTEM username and generated password, and select Test then Connect. For administrative access to the container root, use the ORCL service name and connect as SYS with the SYSDBA role. If port 1521 is already in use on your workstation, forward a different local port, for example -L 1522:127.0.0.1:1521, and connect to localhost:1522.

If application servers need to reach the database directly over the network rather than through a tunnel, see Opening port 1521 deliberately below.

The Oracle binaries, the datafiles, the redo logs and the archive area are stored under /opt/oracle, which is a dedicated EBS volume separate from the operating system disk. Confirm the mount:

findmnt /opt/oracle

The output shows /opt/oracle is its own ext4 filesystem on a separate device. Check the available space at any time with:

df -h /opt/oracle

Because the database tier is on its own volume you can take an Amazon EBS snapshot of it on its own schedule, and you can grow it independently of the root volume.

Oracle Database is managed through systemd as the oracle-db.service unit, which starts the database and the listener automatically on boot, as confirmed in step 5. Check the service status:

systemctl status oracle-db.service --no-pager

Stop, start and restart the service when needed. Stopping the service runs Oracle's dbshut to close the database cleanly, and starting it runs dbstart:

sudo systemctl stop oracle-db.service
sudo systemctl start oracle-db.service
sudo systemctl restart oracle-db.service

The Oracle alert log and listener log live under /opt/oracle/diag. Review the alert log first when diagnosing a startup or runtime problem; locate it with:

sudo su - oracle -c 'find /opt/oracle/diag -name alert_ORCL.log'

Oracle Database includes Recovery Manager (RMAN) for consistent, online backups. Run RMAN as the oracle user against the local instance to take a full backup of the container database and its pluggable databases:

sudo su - oracle . ~/setEnv.sh rman target / <<'RMAN' BACKUP DATABASE PLUS ARCHIVELOG; RMAN

For logical, schema-level exports, use Oracle Data Pump against the pluggable database:

expdp system/<SYSTEM_PASSWORD>@localhost:1521/ORCLPDB \
  schemas=APPUSER directory=DATA_PUMP_DIR dumpfile=appuser.dmp

Because /opt/oracle is a dedicated EBS volume, you can also take an EBS snapshot of the volume itself for a point-in-time copy of the entire database tier. For a crash-consistent snapshot, place the database in backup mode or shut it down cleanly first.