rds-oracle

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: database, debugging, networking, oracle, rds.

What it does

Diagnoses and resolves Amazon RDS for Oracle connectivity, authentication, networking, and driver troubleshooting. Applicable to any RDS-for-Oracle question including connecting a Python Lambda to RDS Oracle in a VPC with pooling and cold-start optimization, EKS pods to RDS Oracle via the Secrets Manager CSI driver with IRSA and SecretProviderClass, ORA-12170 cross-VPC timeouts from EC2, DPI-1047 cannot-locate-64-bit-Oracle-Client errors, and Oracle Connection Manager (CMAN) on EC2 as a proxy with HA across two AZs. Covers python-oracledb thin vs thick mode, init_oracle_client, RDS Proxy does NOT support RDS Oracle, port 1521, VPC peering, Transit Gateway, Kerberos with AWS Managed Microsoft AD, SSL/TLS/NNE, SSM port forwarding, EC2/ECS Fargate/EKS/Lambda, SQL Developer/DBeaver/Toad/SQLcl, and Secrets Manager.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill rds-oracle

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/database-skills/rds-oracle ~/.claude/skills/rds-oracle

Safety box score

Grade D, elevated risk: 65 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a broad RDS-for-Oracle operations toolbox: it diagnoses connectivity and auth issues, but it also includes workflows to create and modify RDS, IAM, networking, EKS, Lambda, and CMAN resources. The main risks are machine-wide privilege changes, live cloud infrastructure changes, and fetching/applying external artifacts during setup.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships runnable scripts and shell commands (`scripts/test_connectivity.sh`, `scripts/test_oracle_connection.py`) and uses local command execution such as `bash -c`, AWS CLI, and Python/oracledb.
Network access	2 (moderate)	It makes AWS API calls and downloads remote artifacts, including CA bundles from `truststore.pki.rds.amazonaws.com` and a provider manifest from a raw GitHub URL.
Filesystem reach	2 (moderate)	It writes or edits host-level paths outside the project, such as `/etc/krb5.conf`, `/etc/systemd/system/oracle-cman.service`, `/usr/local/share/ca-certificates`, and `~/.bash_profile`.
Secrets & credentials	2 (moderate)	It handles AWS Secrets Manager credentials and password-bearing JSON secrets, and the test script reads `ORACLE_PASSWORD`; it discourages hardcoding but still accesses secret material.
Privilege & persistence	3 (high)	It explicitly uses `sudo`, `systemctl enable/start`, package installs, and trust-store writes, which can change machine-wide configuration and services.
Instruction hijack surface	0 (none)	I found no hidden instructions, prompt-hijack text, or requests to ignore confirmations; the skill actually requires explicit user confirmation before create/modify actions.
Irreversible actions	3 (high)	It can create and modify RDS, IAM, VPC, Lambda, and EKS resources (`create-db-instance`, `modify-db-instance`, `eksctl create iamserviceaccount`, `aws ec2 create-vpc-endpoint`), which is inherent to the skill's purpose.
Transparency	2 (moderate)	Some setup depends on unpinned or remote runtime content, such as `kubectl apply -f https://raw.githubusercontent.com/...` and `helm install` from a chart repo, so reviewers cannot fully inspect what will run locally.

Before installing

Read `references/cman-proxy.md` and `references/compute-runtime.md` if you do not want sudo/systemd or cluster-manifest changes.
Check whether you are comfortable with the skill making AWS API calls that can create or modify RDS, IAM, VPC, Lambda, and EKS resources.
Inspect the remote-install lines in `references/compute-runtime.md` before using the EKS setup path (`kubectl apply` from GitHub raw, Helm chart install).
Run the bundled scripts in a scratch account or nonproduction VPC first: `scripts/test_connectivity.sh`, `scripts/check_rds_status.sh`, and `scripts/test_oracle_connection.py`.

Rated 2026-10-20 by an automated review of 18 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/database-skills/rds-oracle/SKILL.md
Branch: main
Updated: 2026-09-19

rds-sqlserver — Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server.
connecting-to-data-source — Create and troubleshoot AWS Glue connections to JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS), Redshift, Snowflake, and BigQuery.
redshift-guide — Amazon Redshift is NOT PostgreSQL — corrects PostgreSQL-derived LLM mistakes; covers Redshift-specific SQL, DDL, COPY/UNLOAD, system views, metadata discovery.
amazon-dynamodb — Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition/sort keys and GSIs.
exporting-rds-to-s3 — Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration.
rds-db2 — Provisions, connects, migrates, and operates Amazon RDS for Db2.