Java编写的AWS Lambda使用连接钱包无法连接Oracle RDS问题咨询

1. 修正Java代码中的错误配置 #

• 钱包路径配置格式错误：oracle.net.wallet_location需要指定钱包所在目录，格式必须符合Oracle要求，不能直接指向cwallet.sso文件
• 修正参数拼写与错误配置：
  • oracle.net.SSL_CYFER_SUITES拼写错误，应为oracle.net.ssl_cipher_suites
  • 删除无效参数oracle.net.ssl_version1，AWS RDS Oracle 19c默认禁用TLS 1.0，需替换为适配版本参数oracle.net.ssl_version = 1.2
• 修改后的testConnection方法代码如下：

public void testConnection()
{
    try      
    {
        System.out.println("Before connect");
        System.setProperty("oracle.net.ssl_server_dn_match", "ON");
        System.setProperty("oracle.net.ssl_cipher_suites", "(SSL_RSA_WITH_AES_256_CBC_SHA)");
        System.setProperty("oracle.net.ssl_version", "1.2");
        System.setProperty("oracle.net.ssl_client_authentication", "FALSE");
        // 修正钱包路径配置，指向钱包所在目录即可，不需要指定具体sso文件
        System.setProperty("oracle.net.wallet_location", "(SOURCE=(METHOD=file)(METHOD_DATA=(DIRECTORY=/var/task)))");
        Connection conn = DriverManager.getConnection(
                "jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCPS)(HOST =myhost100.mydomain.fr) (PORT = 2499)))(CONNECT_DATA = (SID = MYSID01))(SECURITY = (SSL_SERVER_CERT_DN = \"C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=mydb100.xyzabc.eu-west-3.rds.amazonaws.com\")))", 
                "myuser", "mypassword");
        System.out.println("After connect");
        if (conn != null) {
            System.out.println("Connected to the database!");
        } else {
            System.out.println("Failed to make connection!");
        }

    } catch (SQLException e) {
        System.err.format("SQL State: %s\n%s", e.getSQLState(), e.getMessage());
        e.printStackTrace();
    } catch (Exception e) {
        e.printStackTrace();
    }
}

2. 补全pom.xml的依赖 #

Oracle JDBC使用钱包需要额外的PKI相关依赖，在dependencies节点下添加以下3个依赖即可：

<dependency>
    <groupId>com.oracle.database.security</groupId>
    <artifactId>oraclepki</artifactId>
    <version>21.1.0.0</version>
</dependency>
<dependency>
    <groupId>com.oracle.database.security</groupId>
    <artifactId>osdt_cert</artifactId>
    <version>21.1.0.0</version>
</dependency>
<dependency>
    <groupId>com.oracle.database.security</groupId>
    <artifactId>osdt_core</artifactId>
    <version>21.1.0.0</version>
</dependency>

3. 辅助检查项 #

• 确认cwallet.sso文件打包后确实在jar包根目录，Lambda运行时路径为/var/task/cwallet.sso
• 确认RDS安全组入站规则允许Lambda所属安全组访问2499端口，Lambda安全组出站规则允许访问RDS的2499端口
• 确认Lambda所属子网的路由表可以直达RDS所在子网，无网络ACL限制对应端口访问

内容的提问来源于stack exchange，提问作者ARINDAM BANERJEE