Amazon Bedrock integration for RDS for Oracle

RDS for Oracle supports integration with Amazon Bedrock, enabling you to invoke foundation models directly from your Oracle database using SQL. With this integration, you can use generative AI capabilities such as text generation, summarization, and embedding generation without moving data out of your database.

Requirements for Bedrock integration

To use Amazon Bedrock integration with RDS for Oracle, ensure that the following requirements are met.

Database requirements

AWS credentials requirements

Amazon VPC network requirements

The RDS for Oracle DB instance must be able to reach the Amazon Bedrock runtime endpoint (bedrock-runtime.region.amazonaws.com) on port 443 (HTTPS). You can achieve this in one of the following ways.

Option 1: Amazon VPC interface endpoint (AWS PrivateLink) – recommended

Create a Amazon VPC interface endpoint for the Amazon Bedrock runtime service. This keeps all traffic private within the AWS network and doesn't require internet access.

Option 2: NAT gateway (internet route)

If you don't use a Amazon VPC endpoint, the DB instance's subnet must have a route to the internet through a NAT gateway.

The following table summarizes the network paths.

Configuring Bedrock integration

To configure Amazon Bedrock integration for your RDS for Oracle DB instance, complete the following steps.

Step 1: Configure Amazon VPC network connectivity

Ensure that your DB instance can reach the Bedrock runtime endpoint by using one of the network options described in Amazon VPC network requirements. To verify connectivity after configuration, you can test from the database in a later step.

Step 2: Obtain AWS credentials with Bedrock permissions

Create an IAM user or role with the following policy (or attach it to an existing identity).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:region::foundation-model/*"
      ]
    }
  ]
}

To restrict access to specific models, replace the wildcard with specific model ARNs, for example:

"arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0"

Generate access keys for this IAM user from the IAM console. You need the access key ID and secret access key for the next step.

Step 3: Grant database privileges

Connect as a DBA and grant the necessary privileges to the application user.

-- Grant EXECUTE on DBMS_CLOUD and DBMS_CLOUD_AI
GRANT EXECUTE ON DBMS_CLOUD TO db_user;
GRANT EXECUTE ON DBMS_CLOUD_AI TO db_user;

Step 4: Grant network ACL access for the Bedrock endpoint

Grant the database user network ACL access to the Bedrock runtime endpoint.

BEGIN
  DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
    host => 'bedrock-runtime.region.amazonaws.com',
    ace  => xs$ace_type(
              privilege_list => xs$name_list('http'),
              principal_name => 'db_user',
              principal_type => xs_acl.ptype_db)
  );
END;
/

Replace region with your AWS Region (for example, us-east-1) and db_user with the Oracle database user that will invoke Bedrock models.

Step 5: Create a credential in the database

Connect as the application user and create a credential object by using DBMS_CLOUD.

BEGIN
  DBMS_CLOUD.CREATE_CREDENTIAL(
    credential_name => 'AWS_BEDROCK_CRED',
    username        => 'your_AWS_access_key_id',
    password        => 'your_AWS_secret_access_key'
  );
END;
/

Step 6: Create an AI profile for Bedrock

Create an AI profile by using DBMS_CLOUD_AI that references your credential and specifies AWS as the provider.

BEGIN
  DBMS_CLOUD_AI.CREATE_PROFILE(
    profile_name => 'BEDROCK_PROFILE',
    attributes   => '{"provider": "aws",
      "credential_name": "AWS_BEDROCK_CRED",
      "model": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
      "object_list": [{"owner": "schema", "name": "table1"},
                      {"owner": "schema", "name": "table2"}]
    }'
  );
END;
/

To use an Amazon Bedrock runtime endpoint in a Region other than us-east-1, include the region and target_language attributes in the profile attributes JSON. Set region to the Region where your Amazon Bedrock runtime endpoint is located (for example, us-west-2).

If you set region, you must also include target_language or source_language. You must set both attributes together, even for actions that do not use translation, such as chat or runsql.

The target_language value affects only the translate action. If you include only target_language without region, the profile continues to use bedrock-runtime.us-east-1.amazonaws.com.

The following example creates a profile that uses the us-west-2 Region.

BEGIN
  DBMS_CLOUD_AI.CREATE_PROFILE(
    profile_name => 'BEDROCK_PROFILE_USW2',
    attributes   => '{"provider": "aws",
      "credential_name": "AWS_BEDROCK_CRED",
      "region": "us-west-2",
      "target_language": "en",
      "model": "us.anthropic.claude-sonnet-4-5-20250929-v1:0",
      "object_list": [{"owner": "schema", "name": "table1"},
                      {"owner": "schema", "name": "table2"}]
    }'
  );
END;
/

You must specify the model attribute explicitly. No default model is provided for the AWS provider. For model IDs, see the following references:

Verifying your Bedrock integration

Test connectivity with a simple prompt.

EXEC DBMS_CLOUD_AI.SET_PROFILE('BEDROCK_PROFILE');
SELECT AI chat what is Amazon RDS;

If the response returns successfully, your Bedrock integration is configured correctly.

Using Bedrock integration

After you configure the integration, you can invoke Amazon Bedrock foundation models from your Oracle database using SQL with Select AI.

For complete usage examples with Amazon Bedrock – including SELECT AI actions (runsql, showsql, narrate, chat, and explainsql), the DBMS_CLOUD_AI.GENERATE function, multi-turn conversations, and retrieval augmented generation (RAG) – see the following Oracle documentation: