python-oracledb在Lambda中TLS连接AWS RDS Oracle配置问题

我尝试使用Python oracledb库（cx_Oracle的后续替代版本）从AWS Lambda通过TLS连接RDS Oracle实例，后续可能需要配置双向TLS，但当前优先实现单向TLS即可，现寻求相关配置帮助。

已验证可正常运行的操作 #

• 本地PC端可通过SQL Developer使用TLS连接RDS Oracle，仅需将AWS RDS 2019根证书导入Java Keystore，无需使用Oracle wallet。
• Lambda Python 3.9环境下，可使用python-oracledb的thin模式建立非加密连接访问Oracle RDS。
• 本地PC端Python环境下，可使用python-oracledb的thin模式建立非加密连接访问Oracle RDS。

已确认该问题与防火墙策略无关，AWS侧已开放对应服务端口。

测试代码 #

代码基础逻辑与Oracle官方提供的连接示例基本一致，如下：

import oracledb
import sys
import boto3
        
# 创建Lambda函数时，需确保正确配置LD_LIBRARY_PATH环境变量
def lambda_handler(event, context):

    ssm_parameter = boto3.client('ssm')
    
    # 非加密连接可正常运行
    # oracleDSN = "dbname.accountstring.ap-southeast-2.rds.amazonaws.com:2484/servicename"
    
    oracleDSN = '''(description= (retry_count=3)(retry_delay=1)(address=(protocol=tcps)
(port=2484)(host=dbname.accountstring.ap-southeast-2.rds.amazonaws.com))(connect_data=(service_name=servicename))
(security=(ssl_server_cert_dn="C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=dbname.accountstring.ap-southeast-2.rds.amazonaws.com")))'''

    connRds = oracledb.connect(user=database_user, password=database_password, dsn=oracleDSN)

报错信息 #

Lambda返回的报错信息如下（敏感内容已替换处理）：

Response
{
  "errorMessage": "DPY-6005: cannot connect to database. Connection failed with \"[SSL] internal error (_ssl.c:2633)\"",
  "errorType": "OperationalError",
  "requestId": "",
  "stackTrace": [
    "  File \"/var/lang/lib/python3.9/importlib/__init__.py\", line 127, in import_module\n    return _bootstrap._gcd_import(name[level:], package, level)\n",
    "  File \"<frozen importlib._bootstrap>\", line 1030, in _gcd_import\n",
    "  File \"<frozen importlib._bootstrap>\", line 1007, in _find_and_load\n",
    "  File \"<frozen importlib._bootstrap>\", line 986, in _find_and_load_unlocked\n",
    "  File \"<frozen importlib._bootstrap>\", line 680, in _load_unlocked\n",
    "  File \"<frozen importlib._bootstrap_external>\", line 850, in exec_module\n",
    "  File \"<frozen importlib._bootstrap>\", line 228, in _call_with_frames_removed\n",
    "  File \"/var/task/TableDailyCount.py\", line 50, in <module>\n    connRds = oracledb.connect(user=database_user, password=database_password, dsn=oracleDSN)\n",
    "  File \"/opt/python/oracledb/connection.py\", line 1000, in connect\n    return conn_class(dsn=dsn, pool=pool, params=params, **kwargs)\n",
    "  File \"/opt/python/oracledb/connection.py\", line 128, in __init__\n    impl.connect(params_impl)\n",
    "  File \"src/oracledb/impl/thin/connection.pyx\", line 345, in oracledb.thin_impl.ThinConnImpl.connect\n",
    "  File \"src/oracledb/impl/thin/connection.pyx\", line 163, in oracledb.thin_impl.ThinConnImpl._connect_with_params\n",
    "  File \"src/oracledb/impl/thin/connection.pyx\", line 129, in oracledb.thin_impl.ThinConnImpl._connect_with_description\n",
    "  File \"src/oracledb/impl/thin/connection.pyx\", line 247, in oracledb.thin_impl.ThinConnImpl._connect_with_address\n",
    "  File \"/opt/python/oracledb/errors.py\", line 103, in _raise_err\n    raise exc_type(_Error(message)) from cause\n"
  ]
}

已尝试的解决方案 #

• 查阅了所有相关官方文档，本人具备充足技术经验，但接触Python和Oracle的时间较短。
• 将RDS pem根证书放入部署包并作为keystore引用，未生效。
• 参照公开的Python SSL错误修复教程（页面需免费注册后查看），将RDS CA证书导入本地Python39目录（C:\Users\Me\AppData\Roaming\Python\Python39）下三个不同的cacerts文件，未生效。
• 检索了互联网上所有可查的相关公开资料。
• 尝试配置wallet：先创建p12格式wallet并导入RDS证书，因oracledb官方提供的脚本无法正常运行，通过openssl将其转换为pem格式；同时也尝试直接将AWS RDS证书放入Lambda部署包，均未生效。所用证书为AWS官方文档提供的ap-southeast-2区域RDS证书包ap-southeast-2-bundle.pem。

待解决问题 #

• 如何正确配置python-oracledb thin模式，在Lambda环境下实现到RDS Oracle的单向TLS连接？
• 如何基于AWS RDS悉尼（ap-southeast-2）区域根证书生成符合oracledb要求格式的ewallet.pem文件？

内容的提问来源于stack exchange，提问作者Tim