AutoSys Oracle Account: DBA Role Requirements and Security Best Practices

Products

• Autosys Workload Automation

Issue/Introduction

Does the Oracle account used by AutoSys require the DBA role for normal operations? Can this privilege be removed to comply with security standards without impacting application functionality?

Resolution

No, the Oracle DBA role is not an application requirement for the normal runtime functionality of AutoSys.

AutoSys utilizes two distinct database accounts, each with different privilege requirements:

1. AEDBADMIN (Schema Owner):

   • Purpose: Used primarily during installation, upgrades, and patching.
   • Privilege Requirement: This account requires elevated privileges during administrative tasks to create database objects (for example: views/tables, and public synonyms)
   • Security Recommendation: Many organizations revoke the DBA role from this account during normal operations. However, it add it back temporarily whenever an upgrade or patch is applied.

2. AUTOSYS (Runtime User):

   • Purpose: Used for daily application processing and service connectivity.
   • Privilege Requirement: This account only requires basic privileges such as CONNECT, RESOURCE, and specific grants on the AEDBADMIN schema objects. It does not require the DBA role.
   • Configuration Check: You can identify the configured runtime user by running: grep -i dbaccess $AUTOUSER/config.$AUTOSERV

Considerations

• Maintenance Tasks: The AutoSys maintenance task dbstatistics executes DBMS_GATHER_STATISTICS against the database tables. This task may require specific grants if the DBA role is removed, but it still does not necessitate the full DBA role.
• Official Support: While privileges can be restricted for security compliance, it is recommended to document any deviations from the standard installation grants to ensure they can be easily restored during maintenance windows to avoid installation or patching failures

Additional Information

• For a complete list of minimum required privileges, refer to the official documentation: Install AutoSys Workload Automation with Oracle
• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on the respective region.