Data masking in Amazon RDS for Oracle

This article explains how to use Oracle Data Masking and Subsetting Pack with Amazon RDS for Oracle to safely mask sensitive data in non-production environments while maintaining compliance and referential integrity.

• Deploy Oracle Enterprise Manager Cloud Control on EC2 to connect to RDS for Oracle instances
• Create Application Data Models to map schema structure, table relationships, and identify sensitive columns
• Discover sensitive data using automated scanning for PII types like credit cards, emails, and dates of birth
• Generate masking scripts from OEM and run them manually on cloned RDS instances since RDS lacks OS-level access
• Automate end-to-end workflow using EventBridge and Step Functions for repeatable refresh pipelines
• AWS-native alternatives include AWS Glue Visual ETL and AWS DMS data masking for simpler PII redaction scenarios

This approach enables organizations to safely refresh non-production environments with production-like data while meeting GDPR, HIPAA, and PCI DSS compliance requirements without exposing actual customer information.