SOS - AWS RDS Oracle connection

Nelson de Menezes Neto (Meneizs)

unread,

Nov 26, 2025, 7:32:24 PM (7 days ago) Nov 26

to debezium

Hey folks!
I'm trying to connect de debezium 3.1.2 to a AWS RDS Oracle, but my infra team tell me that they can't set my grant like the documentation says (with C## prefix, and --ALL CONTAINERS).
When i try to run my connector with config bellow, i got the following error:

config:
    database.connection.adapter: "logminer"
    database.hostname: ""
    database.port: "1522"
    database.user: ""
    database.password: ""
    database.dbname: ""
    topic.prefix: "oracle-nix"
    table.include.list: "nix.GAIA083PRD.TME_ITPROC"
    snapshot.mode: "schema_only"
    snapshot.fetch.continuously: "true"
    schema.history.internal.kafka.bootstrap.servers: "midas-kafka-cluster-kafka-bootstrap:9092"
    schema.history.internal.kafka.topic: "schema-changes.oracle.nix.v3"
    schema.history.internal.store.only.captured.tables.ddl: "true"

error:
Caused by: oracle.jdbc.OracleDatabaseException: ORA-65040: operation not allowed from within a pluggable database │
│ ORA-06512: at "SYS.DBMS_LOGMNR", line 78 │
│ ORA-06512: at line 1 │
│ │
│ at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:636) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:563) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1150) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:770) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:298) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:497) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CCallableStatement.doOall8(T4CCallableStatement.java:147) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CCallableStatement.executeForRows(T4CCallableStatement.java:1047) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.executeSQLStatement(OracleStatement.java:1530) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1310) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3745) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OraclePreparedStatement.execute(OraclePreparedStatement.java:3940) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleCallableStatement.execute(OracleCallableStatement.java:4278) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OraclePreparedStatementWrapper.execute(OraclePreparedStatementWrapper.java:1009) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at io.debezium.connector.oracle.logminer.LogMinerStreamingChangeEventSource.initializeRedoLogsForMining(LogMinerStreamingChangeEventSource.java:412) ~[debezium-connector-oracle-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.connector.oracle.logminer.LogMinerStreamingChangeEventSource.execute(LogMinerStreamingChangeEventSource.java:179) ~[debezium-connector-oracle-3.1.2.Final.jar:3.1.2.Final] │
│ ... 9 more

And when i set the database.pdb.name to my pdb name, i got the following error:
Caused by: oracle.jdbc.OracleDatabaseException: ORA-01031: insufficient privileges │
│ │
│ at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:636) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:563) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1150) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:770) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:298) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:497) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CStatement.doOall8(T4CStatement.java:111) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.T4CStatement.executeForRows(T4CStatement.java:1010) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.executeSQLStatement(OracleStatement.java:1530) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1310) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.executeInternal(OracleStatement.java:2162) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatement.execute(OracleStatement.java:2117) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at oracle.jdbc.driver.OracleStatementWrapper.execute(OracleStatementWrapper.java:327) ~[bf7b17ca.jar:21.9.0.0.0] │
│ at io.debezium.connector.oracle.OracleConnection.setContainerAs(OracleConnection.java:133) ~[debezium-connector-oracle-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.connector.oracle.OracleConnection.resetSessionToCdb(OracleConnection.java:126) ~[debezium-connector-oracle-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.connector.oracle.OracleSnapshotChangeEventSource.close(OracleSnapshotChangeEventSource.java:256) ~[debezium-connector-oracle-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.pipeline.source.AbstractSnapshotChangeEventSource.execute(AbstractSnapshotChangeEventSource.java:109) ~[debezium-core-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.pipeline.ChangeEventSourceCoordinator.doSnapshot(ChangeEventSourceCoordinator.java:294) ~[debezium-core-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.pipeline.ChangeEventSourceCoordinator.doSnapshot(ChangeEventSourceCoordinator.java:278) ~[debezium-core-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.pipeline.ChangeEventSourceCoordinator.executeChangeEventSources(ChangeEventSourceCoordinator.java:192) ~[debezium-core-3.1.2.Final.jar:3.1.2.Final] │
│ at io.debezium.pipeline.ChangeEventSourceCoordinator.lambda$start$0(ChangeEventSourceCoordinator.java:143) ~[debezium-core-3.1.2.Final.jar:3.1.2.Final] │
│ ... 5 more

The infra team executed the grants bellow for my user:
-- 4 Roles for DATALAKECDC
GRANT CONNECT TO DATALAKECDC;
GRANT EXECUTE_CATALOG_ROLE TO DATALAKECDC;
GRANT READ_NIX_PRD TO DATALAKECDC;
GRANT SELECT_CATALOG_ROLE TO DATALAKECDC;
ALTER USER DATALAKECDC DEFAULT ROLE ALL;
-- 8 System Privileges for DATALAKECDC
GRANT CREATE SEQUENCE TO DATALAKECDC;
GRANT CREATE SESSION TO DATALAKECDC;
GRANT CREATE TABLE TO DATALAKECDC;
GRANT FLASHBACK ANY TABLE TO DATALAKECDC;
GRANT LOCK ANY TABLE TO DATALAKECDC;
GRANT LOGMINING TO DATALAKECDC;
GRANT SELECT ANY TABLE TO DATALAKECDC;
GRANT SELECT ANY TRANSACTION TO DATALAKECDC;
-- 1 Tablespace Quota for DATALAKECDC
ALTER USER DATALAKECDC QUOTA UNLIMITED ON TBS_DATALAKEPRD;
-- 17 Object Privileges for DATALAKECDC
GRANT READ ON DIRECTORY ARCHIVELOG_DIR TO DATALAKECDC;
GRANT EXECUTE ON SYS.DBMS_LOGMNR TO DATALAKECDC WITH GRANT OPTION;
GRANT EXECUTE ON SYS.DBMS_LOGMNR_D TO DATALAKECDC WITH GRANT OPTION;
GRANT READ ON DIRECTORY ONLINELOG_DIR TO DATALAKECDC;
GRANT SELECT ON SYS.V_$ARCHIVE_DEST_STATUS TO DATALAKECDC WITH GRANT OPTION;
GRANT SELECT ON SYS.V_$ARCHIVED_LOG TO DATALAKECDC;
GRANT SELECT ON SYS.V_$DATABASE TO DATALAKECDC;
GRANT SELECT ON SYS.V_$LOG TO DATALAKECDC;
GRANT SELECT ON SYS.V_$LOGFILE TO DATALAKECDC;
GRANT SELECT ON SYS.V_$LOG_HISTORY TO DATALAKECDC WITH GRANT OPTION;
GRANT SELECT ON SYS.V_$LOGMNR_CONTENTS TO DATALAKECDC WITH GRANT OPTION;
GRANT SELECT ON SYS.V_$LOGMNR_LOGS TO DATALAKECDC WITH GRANT OPTION;
GRANT SELECT ON SYS.V_$LOGMNR_PARAMETERS TO DATALAKECDC WITH GRANT OPTION;
GRANT SELECT ON SYS.V_$MYSTAT TO DATALAKECDC;
GRANT SELECT ON SYS.V_$PARAMETER TO DATALAKECDC;
GRANT SELECT ON SYS.V_$STATNAME TO DATALAKECDC;
GRANT SELECT ON SYS.V_$TRANSACTION TO DATALAKECDC;

What im missing??

Chris Cranford

unread,

Nov 26, 2025, 7:36:42 PM (7 days ago) Nov 26

to debe...@googlegroups.com

Hi

If your database is using multi-tenancy, the `database.user` must be the common user, a user account prefixed with `c##`. The grants must be issued on this user for all containers. It appears that perhaps based on the grants you've shown, you're using a local user and that will only work in a non-multi-tenancy environment. And when the database is using multi-tenancy (CDB in V$DATABASE is YES), the `database.pdb.name` must be supplied and point to the PDB while `database.dbname` refers to the container root database.

Let us know if you have any questions.
-cc

What im missing?? --
You received this message because you are subscribed to the Google Groups "debezium" group.
To unsubscribe from this group and stop receiving emails from it, send an email to debezium+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/debezium/3dddb14f-cfa4-4bf6-acbc-c199feab4841n%40googlegroups.com.

Nelson de Menezes Neto (Meneizs)

unread,

Nov 26, 2025, 8:25:32 PM (7 days ago) Nov 26

to debezium

I've confirmed with infra team, and my oracle in aws rds is single-tenant.
When i set to snapshot initial, the snapshot works, when goes to the cdc part it fails..
The PDB and the database it's the same name: "NIX"

There's something that im doing wrong??
The only grant that the infra couldnt set is >> GRANT SET CONTAINER TO DATALAKECDC CONTAINER=ALL
Error at line 1
ORA-65029: um Usuário Local não pode conceder ou revogar um Privilégio Comum ou Atribuição

Can you help me? The deadline is coming... :(

Chris Cranford

unread,

Nov 27, 2025, 4:48:13 PM (6 days ago) Nov 27

to debe...@googlegroups.com

I'm afraid we're potentially mixing terminology here and I want to be very clear. Please execute the following query

SELECT CDB
FROM V$DATABASE

If CDB == YES:

1. "database.dbname" is either the value returned from the following query or the service that refers to this SID:
SELECT NAME FROM V$DATABASE

2. "database.pdb.name" is the PDB tenant name, which is not the same as database.dbname

3. Execution of GRANTs for the connector user must include the "CONTAINER=ALL" clause.

4. "database.user" is a common user, and must be prefixed with "c##" as Debezium needs to execute in both the PDB and CDB$ROOT contexts.
Debezium uses the PDB for the snapshot phase while it uses the CDB$ROOT context for the streaming phase.

If CDB == NO:

1. "database.dbname" is either the value returned from the following query or the service that refers to this SID:
SELECT NAME FROM V$DATABASE

2. "database.pdb.name" is not used.

3. Execution of GRANTs do not include the "CONTAINER=ALL" clause.

4. "database.user" is a local user, meaning it is NOT prefixed with "c##"

Let me know if something remains unclear.

-cc

To view this discussion visit https://groups.google.com/d/msgid/debezium/5dbfa337-2d60-4dcf-8199-ac49bfd47bafn%40googlegroups.com.

Reply all

Reply to author

Forward