Centralized traffic inspection for Oracle Database@AWS

This article explains two centralized traffic inspection patterns for Oracle Database@AWS, enabling organizations to inspect network traffic for security and compliance purposes.

• Pattern 1 uses AWS Transit Gateway with a centralized inspection VPC for single-Region deployments
• Pattern 2 uses AWS Cloud WAN with service insertion for multi-Region architectures
• Both patterns route east-west traffic (application to database) and north-south traffic (internet outbound) through firewall endpoints
• Inspection VPCs must be separate from ODB transit VPCs, which don't support inline firewall deployment
• Appliance mode ensures symmetric traffic paths for stateful inspection across Availability Zones
• ODB peered CIDRs must include application VPC and on-premises CIDRs, plus specific internet destination ranges
• DNS queries follow the same inspection path as data traffic; use Route 53 Resolver endpoints to bypass if needed

Both patterns enable regulated industries to implement IDS/IPS, DLP, and domain filtering for Oracle Database@AWS workloads at scale.