oci-dbm-vault

name	oci-dbm-vault
description	Creates or validates a vault secret for the ADB ADMIN password and ensures the IAM policy has both required statements for DBM secret access. Trigger when a user says "set up vault for DBM", "create the DBM secret", or when oci-dbm-commission directs here.

oci-dbm-vault

This skill is a worker in the oci-dbm-commission chain. It does NOT generate scripts. It uses the OCI Python SDK directly to store the ADB ADMIN password as a vault secret and to configure the two IAM policy statements that Database Management requires to read that secret.

---

Inputs

These values are passed by oci-dbm-commission (or supplied directly by the user):

Input	Description	Example
compartment_ocid	OCID of the compartment where the vault and policy live	ocid1.compartment.oc1..aaa...
vault_ocid	OCID of an existing OCI Vault (must already exist)	ocid1.vault.oc1.iad.aaa...
admin_password	The ADB ADMIN password — prompt securely if not provided; never log it	Str0ngP@ss!
secret_name	Name for the secret (default: <dbname>_admin_pwd)	dbmdemo_admin_pwd
db_name	ADB DB name, used to derive default secret_name if not specified	dbmdemo
policy_name	Name of the IAM policy to create or update	dbm-secret-access-policy

---

What This Skill Executes

Step 1 — Check Whether the Secret Already Exists

Call VaultsClient.list_secrets(compartment_id=compartment_ocid, vault_id=vault_ocid) and filter by secret_name.

• If a matching secret is found with lifecycle_state not PENDING_DELETION or DELETED: print its OCID, confirm it, and skip creation (go to Step 3).
• If not found, proceed to Step 2.

Step 2 — Create the Secret

1. Call KmsManagementClient.list_keys(compartment_id=compartment_ocid) to retrieve the master encryption key OCID (key_id) from the vault.
2. Base64-encode the admin_password:

   import base64
   encoded = base64.b64encode(admin_password.encode()).decode()
   

3. Call VaultsClient.create_secret() with:
   • compartment_id=compartment_ocid
   • vault_id=vault_ocid
   • key_id=key_id
   • secret_name=secret_name
   • secret_content=Base64SecretContentDetails(content=encoded, content_type='BASE64', stage='CURRENT')
4. Poll until secret.lifecycle_state == 'ACTIVE'. Print the resulting secret_ocid.

Step 3 — Verify IAM Policy Has Both Required Statements

Call IdentityClient.list_policies(compartment_id=compartment_ocid) and scan all policies for these two statements (substituting actual compartment name and secret OCID):

Statement A — grants DBM managed database principal access to the secret:

Allow any-user to read secret-family in compartment <compartment_name>
  where ALL {target.secret.id = '<secret_ocid>',
              request.principal.type = 'dbmgmtmanageddatabase'}

Statement B — grants the DBM service itself access during the enablement process:

Allow service dbmgmt to read secret-family in compartment <compartment_name>
  where target.secret.id = '<secret_ocid>'

For each missing statement:

• If the target policy exists, retrieve its current statements, append the missing one, and call IdentityClient.update_policy() using UpdatePolicyDetails(statements=[...existing + new...], version_date=None) — do not pass version_date (see Gotcha 2).
• If no policy exists yet, create one with IdentityClient.create_policy() containing both statements.

Step 4 — Output

Print a summary:

• Secret name and OCID
• The two IAM policy statements, confirmed present

Output the following values for the next skill:

secret_ocid: <ocid>
compartment_ocid: <ocid>
vault_validated: true

---

Confirmation Before Finishing

Before handing off, verify:

• VaultsClient.get_secret(secret_id=secret_ocid) returns lifecycle_state = ACTIVE
• Both IAM policy statements are present when list_policies is re-read

Do not proceed if either check fails.

---

What This Skill Hands Back

Outputs passed to oci-dbm-commission (and subsequently to oci-dbm-enable):

• secret_ocid — OCID of the active vault secret containing the ADMIN password
• compartment_ocid — unchanged, forwarded for downstream skills
• vault_validated: true — signal that this step completed successfully

---

Gotchas

Gotcha 1 — Statement B is required even before a managed database exists.

Statement A (granting dbmgmtmanageddatabase principal type) only takes effect once the database is registered as a managed database. Statement B (granting service dbmgmt) is what allows the enablement call itself to read the secret. Omitting Statement B causes a silent credential-access failure during enable_autonomous_database_management_feature(). Both statements must be present before calling the enable skill.

Gotcha 2 — Omit version_date from UpdatePolicyDetails.

Passing version_date (even as None explicitly typed as a date object, or as an empty string) triggers a 400 InvalidParameter error from the IAM API. Leave the field entirely absent from the UpdatePolicyDetails constructor, or pass version_date=None only if the SDK accepts it as a no-op. Test with a GET after the update to confirm the statements persisted.