14.1 Autonomous Recovery Service: Protection Policies, Real-Time Protection & Retention Lock
Key Takeaways
Autonomous Recovery Service is based on Oracle Zero Data Loss Recovery Appliance technology and is Oracle's recommended destination for Oracle-managed automatic database backups.
Recovery Service uses an incremental-forever backup approach, which removes the need for weekly full backups.
Oracle-defined protection policies retain backups for 14 days (Bronze), 35 days (Silver), 65 days (Gold), or 95 days (Platinum).
Real-Time Protection continuously sends redo to Recovery Service, allowing recovery to within less than a second of an outage, as a premium option.
With retention lock enabled on a protection policy, nobody can modify or delete backups until the retention period expires.
What Autonomous Recovery Service Is
Oracle Database Zero Data Loss Autonomous Recovery Service, usually called Autonomous Recovery Service or Recovery Service, is a fully managed service built on the technology of the on-premises Oracle Zero Data Loss Recovery Appliance (ZDLRA). It protects Oracle databases running on:
- Exadata Database Service on Dedicated Infrastructure and on Exascale Infrastructure
- Oracle Base Database Service
- Oracle Database@AWS, Oracle Database@Azure, and Oracle Database@Google Cloud
- On-premises databases, through Oracle Database Zero Data Loss Cloud Protect
Oracle recommends selecting Recovery Service as the destination for Oracle-managed automatic backups of these cloud databases. Autonomous AI Database is not on this list because it manages its own automatic backups, as covered in Chapter 13.
Why Use It Instead of Object Storage Backups
| Capability | What it means |
|---|---|
| Incremental-forever backups | After the first backup, only changed blocks are sent and the service builds virtual full backups. Weekly full backups are no longer needed, which reduces database CPU, memory, I/O, and the backup window. |
| Backup validation | All backups are validated for data anomalies that could affect recovery. |
| Immutability and enforced encryption | Backups cannot be altered by anyone in the tenancy and are always encrypted, which matters for ransomware protection. |
| Central protection dashboard | Shows whether backups are healthy, how long since the last backup, how far back you can recover, and how much space backups use. |
| Real-Time Protection (premium) | Continuous redo shipping that allows recovery to within less than a second of an outage or attack. |
Without Real-Time Protection, Recovery Service backups cost the same as Object Storage backups. Real-Time Protection is the premium Zero Data Loss option. It continuously transfers redo changes to the service, giving an RPO near zero, instead of losing everything since the last scheduled backup.
Protection Policies
A protection policy sets the backup retention period for the databases that use it.
| Oracle-defined policy | Retention |
|---|---|
| Bronze | 14 days |
| Silver | 35 days |
| Gold | 65 days |
| Platinum | 95 days |
Oracle-defined policies cannot be modified. You can create custom policies with a retention period from 14 to 95 days. Long-term retention (LTR) backups for compliance are created through the database service and are kept for their own specified retention period.
Retention Lock
A custom protection policy can enable a retention lock. After the lock takes effect, following a minimum 14-day delay, the retention period can only be increased, and nobody can modify or delete backups until the retention period expires, including tenancy administrators. With a lock in place, terminating a database or disabling its automatic backups does not delete the backups early; they are deleted only after the retention period ends.
Multicloud Backup Location
For Oracle Database@AWS, @Azure, and @Google Cloud, you can choose to store backups in the same cloud as the database, for example to meet data residency rules.
Enabling Backups and the Protected Database Resource
When you enable automatic backups for a database with Recovery Service as the destination, you choose a protection policy, decide whether to enable Real-Time Protection, and choose a deletion option:
- Retain backups according to the protection policy retention period after the database is terminated.
- Retain backups for 72 hours, then delete.
Recovery Service then creates a protected database resource that represents the database. Its Health shows Protected, Warning, or Alert, and its details show the recovery window and space used. When a database is terminated, its protected database enters the Delete Scheduled state until the chosen delay ends.
Network and IAM Prerequisites
Recovery Service connects to the database through a Recovery Service subnet that you register in the database VCN:
- Use a private subnet (recommended), IPv4 only. Oracle recommends a /24 size.
- Allow stateful ingress on TCP ports 8005 and 2484 from the database, using security lists or up to five NSGs.
- Register the subnet as a Recovery Service subnet resource.
- Add the IAM policy that lets the service manage the networking it needs:
Allow service rcs to manage virtual-network-family in tenancy.
Designing Backup and Recovery With Recovery Service
| Requirement | Design choice |
|---|---|
| Lose as little data as possible during ransomware or a site outage | Enable Real-Time Protection |
| Backups that even administrators cannot delete | Custom policy with retention lock |
| 90-day recovery window | Platinum (95 days) or a custom policy |
| Lower backup overhead on busy databases | Incremental-forever backups offloaded to Recovery Service |
| Regional disaster recovery with a running standby | Data Guard or Full Stack DR; backups are not a replacement for a standby |
Recovery Service is about recoverability: restoring a database to a point in time after corruption, deletion, or attack. Fast regional failover still comes from Data Guard standbys and Full Stack DR.
A bank's Base Database Service database must be recoverable to within a second of a ransomware attack, and its backups must not be deletable by any tenancy administrator during the retention period. Which configuration meets both requirements?
Object Storage backups with a 60-day retention period and a bucket retention rule
Recovery Service with Real-Time Protection and a policy that has retention lock
Recovery Service with the Oracle-defined Bronze policy and no Real-Time Protection
Daily on-demand full backups copied to another region by a scheduled function
Automatic backups to Recovery Service fail for a new Base Database Service DB system. The database subnet's security list allows only port 1521 inbound. What should the architect check first?
That the database's protection policy is set to Platinum instead of Bronze
That the database uses the Enterprise Edition – Extreme Performance edition
That a registered Recovery Service subnet allows ingress on TCP 8005 and 2484
That Real-Time Protection is enabled so redo can be sent to the Recovery Service
Sections you finish are checked off in the contents.