Oracle¶

Overview¶

Horizon Catalog ingests Oracle metadata via a direct database connection using a dedicated service account with metadata-read privileges. For query logs (used for lineage and popularity) you pick one of three sources:

Prerequisites¶

• Administrative access to the Oracle instance so you can CREATE USER, CREATE ROLE, and GRANT.
• Open the Horizon Catalog connector in another browser tab. To reach it, sign in to Snowflake, open Catalog > Connections, then pick Oracle from the list. For the s3 log source you’ll need two values from the wizard:
  • IAM Principal: The ARN of the Horizon Catalog service role that will assume your role. Copy it verbatim.
  • External ID: A per-connector secret starting with sf_horizon_. Don’t regenerate or rewrite it.
• Only if you’ll use the DAS (s3) log source: an AWS user with permission to create IAM roles/policies, S3 buckets, Kinesis Data Firehose delivery streams, and Lambda functions in the AWS account that hosts the RDS for Oracle instance, plus the ability to enable Database Activity Streams on that instance.

1. Create an Oracle user for Horizon Catalog¶

Connect as an administrative user and create a dedicated service account with metadata-read privileges. Replace <username>, <password>, and <role> with real values.

CREATE USER <username> IDENTIFIED BY <password>;
CREATE ROLE <role>;
GRANT <role> TO <username>;
GRANT CREATE SESSION TO <role>;
GRANT SELECT_CATALOG_ROLE TO <role>;

SELECT_CATALOG_ROLE grants read access to the data dictionary and system views that Horizon Catalog uses to read metadata and (for the system log source) query history.

GRANT SELECT ANY TABLE TO <role>;

2. Ensure network connectivity¶

Horizon Catalog connects to your Oracle instance over the public internet. The instance must be publicly reachable — either set Publicly accessible = Yes on the RDS instance, or place it behind an internet-facing load balancer or proxy you control. Allow inbound TCP on the Oracle port (default 1521).

3. Choose a query-log source¶

• system (default, no AWS work): Horizon Catalog reads Oracle’s system views on each crawl.
• s3 via Database Activity Streams: Full DAS pipeline. See Query Logs.
• none: Metadata only. Lineage and popularity are disabled; metadata sync still works.

4. Finish in the Horizon Catalog UI¶

Back in the connector wizard, fill in the Add data source step:

In the Connect query log step, pick System Table/View, RDS Database Activity Stream, or None. For the DAS option, paste the S3 Bucket, S3 Object Prefix (processed/), AWS Region, and Role ARN from Query Logs.

In the Select databases step, choose the databases you want Horizon Catalog to crawl.

Initial metadata typically appears within a few minutes; for the s3 source, lineage and popularity fill in as Firehose flushes batches into the bucket (up to 15 minutes per batch by default).

Connection security¶

Horizon Catalog uses a TLS-capable Oracle client. If your instance is configured to accept TLS connections, the connection is encrypted automatically. However, if TLS isn’t available on the server, the connection proceeds unencrypted.

For more details on the shared-responsibility model for Horizon Catalog connectors, see Security and data protection.

Troubleshooting¶