refactor(oracle19c): DRY/inheritance trim of TLS work per follow-up review (#519,#538)

Follow-up DRY / over-engineering review (compare to how pg/mysql inherit crypto
from AWS; don't build machinery we don't need). Core stays — Oracle genuinely
requires the SSL option group + TCPS 2484 (unlike pg/mysql same-port TLS), and the
cipher pin is required (the AWS 19c default cipher is documented FedRAMP-No, so we
must override). Trimmed the extras:

- H4: dropped the hardcoded SSL_SERVER_CERT_DN from the binding (uri/jdbcUrl
  descriptor + the ssl_server_cert_dn key). pg/mysql publish no DN; the Oracle
  driver verifies server identity against the CA bundle + ssl_server_dn_match. The
  DN was Amazon-owned + would break on cert rotation, and (M1) was unverified/
  guessed. Kept ssl_required + ssl_server_dn_match + ca_cert_bundle_url.
- Q5 (DRY): extracted ensureOptionGroupWithOptions (describe→create-if-absent→
  modify); both ProvisionBaselineOptionGroup and ProvisionOrModifyCustomOptionGroup
  now call it, removing the byte-identical CreateOptionGroupInput literal +
  ModifyOptionGroup call.
- S1: options.yml is our own committed file, not tenant input — moved the FedRAMP
  value-assertions (TLS==1.2, FIPS on, cipher allowlist) from a runtime guard to a
  CI test (TestOracleSSLBaselineIsFedRAMPCompliant), matching how pg/mysql have no
  runtime param guard. Kept a cheap runtime cipher/CA COMPATIBILITY guard on the
  provision path (option-b: oracleSSLCipherCACompatible) so a future ECDSA-on-RSA
  edit fails before the opaque AWS associate error; removed sortedKeys.
- Docs (connection-examples/binding/hardening-baseline): removed the
  ssl_server_cert_dn references to match.

Tests: TestOracleSSLBaselineIsFedRAMPCompliant (CI gate for the values),
TestOracleSSLCipherCACompatible (runtime guard), TestGetCredentials oracle-se2
updated (no cert DN). go test ./... + cmd/tasks green; go vet + pre-commit green.

Co-authored-by: OpenCode Agent <agent@gsa.gov>

Author: wz-gsa

docs/oracle19c/binding.md

@@ -12,10 +12,10 @@ binding payload into `VCAP_SERVICES` (keys documented in
 `uri` (oracle scheme, TCPS `DESCRIPTION`), `jdbcUrl` (thin, TCPS `DESCRIPTION`),
 `username`, `password`, `host`, `port` (`2484`, TCPS), `protocol` (`tcps`),
 `service_name`/`sid` (`ORCL`), `db_name`, `name`, plus the TLS keys `ssl_required=true`,
-`ssl_server_dn_match=true`, `ssl_server_cert_dn` (the RDS server cert DN), and
-`ca_cert_bundle_url` (the GovCloud RDS CA bundle the client must trust). The `uri`
-and `jdbcUrl` use the full Oracle connect `DESCRIPTION` form (`PROTOCOL=TCPS`,
-`PORT=2484`, `SSL_SERVER_CERT_DN`) — EZConnect cannot express TCPS. No admin/master
+`ssl_server_dn_match=true`, and `ca_cert_bundle_url` (the GovCloud RDS CA bundle the
+client must trust; the driver verifies the server cert against it — no hardcoded DN
+is published). The `uri` and `jdbcUrl` use the full Oracle connect `DESCRIPTION` form
+(`PROTOCOL=TCPS`, `PORT=2484`) — EZConnect cannot express TCPS. No admin/master
 marker keys are present (asserted by `TestOracleBindingDoesNotLeakAdminMarkers`).
 
 > **Encryption in transit (TLS).** The broker provisions an RDS Oracle SSL option

docs/oracle19c/connection-examples.md

@@ -8,8 +8,8 @@ After `cf bind-service my-app my-oracle`, the binding credentials appear in
 
 ```json
 {
-  "uri": "oracle://APP_USER:REDACTED@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=my-oracle.abc.us-gov-west-1.rds.amazonaws.com)(PORT=2484))(CONNECT_DATA=(SID=ORCL))(SECURITY=(SSL_SERVER_CERT_DN=\"C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=my-oracle.abc.us-gov-west-1.rds.amazonaws.com\")))",
-  "jdbcUrl": "jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=my-oracle.abc.us-gov-west-1.rds.amazonaws.com)(PORT=2484))(CONNECT_DATA=(SID=ORCL))(SECURITY=(SSL_SERVER_CERT_DN=\"C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=my-oracle.abc.us-gov-west-1.rds.amazonaws.com\")))",
+  "uri": "oracle://APP_USER:REDACTED@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=my-oracle.abc.us-gov-west-1.rds.amazonaws.com)(PORT=2484))(CONNECT_DATA=(SID=ORCL)))",
+  "jdbcUrl": "jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=my-oracle.abc.us-gov-west-1.rds.amazonaws.com)(PORT=2484))(CONNECT_DATA=(SID=ORCL)))",
   "username": "APP_USER",
   "password": "REDACTED",
   "host": "my-oracle.abc.us-gov-west-1.rds.amazonaws.com",
@@ -21,19 +21,20 @@ After `cf bind-service my-app my-oracle`, the binding credentials appear in
   "name": "ORCL",
   "ssl_required": "true",
   "ssl_server_dn_match": "true",
-  "ssl_server_cert_dn": "C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=my-oracle.abc.us-gov-west-1.rds.amazonaws.com",
   "ca_cert_bundle_url": "https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.pem"
 }
 ```
 
 The binding advertises TLS/TCPS: `port` `2484`, `protocol` `tcps`, and a full
 Oracle connect `DESCRIPTION` (not EZConnect) in both `uri` and `jdbcUrl` carrying
-`PROTOCOL=TCPS` and `SSL_SERVER_CERT_DN`. `ssl_required=true` and
-`ssl_server_dn_match=true` instruct the client to encrypt **and** verify the server
-identity; `ca_cert_bundle_url` is the GovCloud RDS CA bundle the client must trust.
-The instance uses the RDS default RSA CA (`rds-ca-rsa2048-g1`), compatible with the
-ECDHE_RSA cipher. Verified offline + by go unit tests; not yet exercised against a
-live GovCloud RDS TLS handshake (WS15).
+`PROTOCOL=TCPS`. `ssl_required=true` and `ssl_server_dn_match=true` instruct the
+client to encrypt **and** verify the server identity; the client verifies that
+identity against `ca_cert_bundle_url` (the GovCloud RDS CA bundle it must trust) —
+the broker does **not** publish a hardcoded server-cert DN (the RDS cert subject is
+Amazon-owned and rotates; the driver derives it from the trusted cert). The instance
+uses the RDS default RSA CA (`rds-ca-rsa2048-g1`), compatible with the ECDHE_RSA
+cipher. Verified offline + by go unit tests; not yet exercised against a live
+GovCloud RDS TLS handshake (WS15).
 
 > **TLS not yet reachable end-to-end (platform SG, [#541](https://github.com/cloud-gov/aws-broker/issues/541)).**
 > The broker provisions the RDS Oracle SSL option group and the binding expresses
@@ -101,7 +102,7 @@ keytool -importcert -alias rds-ca -file global-bundle.pem \
 ```java
 String url = System.getenv("ORACLE_JDBC_URL"); // the TCPS jdbcUrl from the binding
 // jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=..)(PORT=2484))
-//   (CONNECT_DATA=(SID=ORCL))(SECURITY=(SSL_SERVER_CERT_DN="...")))
+//   (CONNECT_DATA=(SID=ORCL)))
 Properties p = new Properties();
 p.put("user", username);
 p.put("password", password);
@@ -148,8 +149,8 @@ provisions and attaches at create, which serves TLS on a dedicated **TCPS listen
 (port 2484)**: TLS 1.2, cipher `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, and
 `FIPS.SSLFIPS_140=TRUE` (SC-8 / SC-8(1) / SC-13; DISA Oracle 19c STIG V-270579,
 V-270571). The binding advertises this posture (`port=2484`, `protocol=tcps`,
-`ssl_required=true`, `ssl_server_dn_match=true`, `ssl_server_cert_dn`,
-`ca_cert_bundle_url`). RDS Oracle SSL supports **TLS 1.2 only** (no 1.3) — acceptable
+`ssl_required=true`, `ssl_server_dn_match=true`, `ca_cert_bundle_url`). RDS Oracle
+SSL supports **TLS 1.2 only** (no 1.3) — acceptable
 for FedRAMP Moderate. Configure your driver to trust the GovCloud RDS CA bundle and
 require server-DN matching (examples above).
 

docs/oracle19c/hardening-baseline.md

@@ -69,7 +69,8 @@ cipher (an ECDSA-only suite would need the ECC CA and is rejected fail-closed be
 the AWS call). `FIPS.SSLFIPS_140=TRUE` means clients **must** negotiate a
 FIPS/FedRAMP cipher or the handshake fails. The binding advertises the TCPS/2484
 posture (`port=2484`, `protocol=tcps`, `ssl_required=true`, `ssl_server_dn_match`,
-`ssl_server_cert_dn`, `ca_cert_bundle_url`).
+`ca_cert_bundle_url`); the client verifies the server cert against the CA bundle
+(no hardcoded DN is published).
 
 > **TLS-only posture depends on the platform SG ([#541](https://github.com/cloud-gov/aws-broker/issues/541)).**
 > The broker provisions + attaches the SSL option and expresses the 2484 intent, but

services/rds/baselines_test.go

@@ -260,66 +260,54 @@ func indexFold(s, substr string) int {
 	return -1
 }
 
-func TestValidateOracleSSLSecurity(t *testing.T) {
-	base := func() *oracleOptionsFile {
-		return &oracleOptionsFile{
-			CACertFamily: "rsa",
-			Options: []oracleOption{{
-				Name: "SSL", Port: 2484,
-				Settings: []oracleOptionSetting{
-					{Name: "SQLNET.SSL_VERSION", Value: "1.2"},
-					{Name: "SQLNET.CIPHER_SUITE", Value: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"},
-					{Name: "FIPS.SSLFIPS_140", Value: "TRUE"},
-				},
-			}},
-		}
-	}
-	if err := validateOracleSSLSecurity(base()); err != nil {
-		t.Fatalf("valid baseline rejected: %v", err)
+// TestOracleSSLBaselineIsFedRAMPCompliant is the CI gate for the SSL security
+// invariants (S1: options.yml is our own committed file, so the values are enforced
+// by this test rather than a runtime guard — matching how pg/mysql have no runtime
+// param guard). It asserts the SHIPPED baseline is TLS 1.2 + FIPS on + a FedRAMP/FIPS
+// allowlisted cipher; a weakened options.yml fails go test and never merges.
+func TestOracleSSLBaselineIsFedRAMPCompliant(t *testing.T) {
+	f, err := loadOracleOptions()
+	if err != nil {
+		t.Fatal(err)
 	}
+	s := f.sslSettings()
 
-	mutate := func(fn func(m map[string]string)) *oracleOptionsFile {
-		f := base()
-		m := map[string]string{}
-		for _, s := range f.Options[0].Settings {
-			m[s.Name] = s.Value
-		}
-		fn(m)
-		f.Options[0].Settings = nil
-		for k, v := range m {
-			if v == "__delete__" {
-				continue
-			}
-			f.Options[0].Settings = append(f.Options[0].Settings, oracleOptionSetting{Name: k, Value: v})
-		}
-		return f
+	if v := s["SQLNET.SSL_VERSION"]; v != "1.2" {
+		t.Errorf("SQLNET.SSL_VERSION=%q, require exactly \"1.2\" (FedRAMP floor; RDS Oracle ceiling)", v)
 	}
-
-	bad := map[string]func(map[string]string){
-		"tls 1.0 rejected":         func(m map[string]string) { m["SQLNET.SSL_VERSION"] = "1.0" },
-		"tls 1.1 rejected":         func(m map[string]string) { m["SQLNET.SSL_VERSION"] = "1.1" },
-		"missing version rejected": func(m map[string]string) { m["SQLNET.SSL_VERSION"] = "__delete__" },
-		"fips off rejected":        func(m map[string]string) { m["FIPS.SSLFIPS_140"] = "FALSE" },
-		"fips missing rejected":    func(m map[string]string) { m["FIPS.SSLFIPS_140"] = "__delete__" },
-		"weak cipher rejected":     func(m map[string]string) { m["SQLNET.CIPHER_SUITE"] = "TLS_RSA_WITH_AES_128_CBC_SHA" },
-		"3des cipher rejected":     func(m map[string]string) { m["SQLNET.CIPHER_SUITE"] = "TLS_RSA_WITH_3DES_EDE_CBC_SHA" },
-		"missing cipher rejected":  func(m map[string]string) { m["SQLNET.CIPHER_SUITE"] = "__delete__" },
-		"ecdsa on rsa ca rejected": func(m map[string]string) { m["SQLNET.CIPHER_SUITE"] = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" },
-	}
-	for name, fn := range bad {
-		t.Run(name, func(t *testing.T) {
-			if err := validateOracleSSLSecurity(mutate(fn)); err == nil {
-				t.Errorf("expected fail-closed rejection, got nil")
-			}
-		})
+	if v := s["FIPS.SSLFIPS_140"]; !strings.EqualFold(v, "TRUE") {
+		t.Errorf("FIPS.SSLFIPS_140=%q, require TRUE (SC-13)", v)
+	}
+	cipher, ok := s["SQLNET.CIPHER_SUITE"]
+	if !ok || cipher == "" {
+		t.Fatal("SQLNET.CIPHER_SUITE is required")
+	}
+	if _, ok := fedrampOracleSSLCiphers[cipher]; !ok {
+		t.Errorf("cipher %q is not on the FedRAMP/FIPS allowlist", cipher)
 	}
+}
 
-	// The shipped embedded baseline must pass the security guard.
-	shipped, err := loadOracleOptions()
-	if err != nil {
-		t.Fatal(err)
+// TestOracleSSLCipherCACompatible covers the runtime compatibility guard kept on the
+// provision path (option-b): an ECDSA-only cipher on the RSA CA is rejected before
+// the AWS associate call.
+func TestOracleSSLCipherCACompatible(t *testing.T) {
+	ok := &oracleOptionsFile{
+		CACertFamily: "rsa",
+		Options: []oracleOption{{Name: "SSL", Settings: []oracleOptionSetting{
+			{Name: "SQLNET.CIPHER_SUITE", Value: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"},
+		}}},
+	}
+	if err := oracleSSLCipherCACompatible(ok); err != nil {
+		t.Errorf("RSA cipher on RSA CA should be compatible, got %v", err)
 	}
-	if err := validateOracleSSLSecurity(shipped); err != nil {
-		t.Errorf("shipped options.yml fails the SSL security guard: %v", err)
+
+	bad := &oracleOptionsFile{
+		CACertFamily: "rsa",
+		Options: []oracleOption{{Name: "SSL", Settings: []oracleOptionSetting{
+			{Name: "SQLNET.CIPHER_SUITE", Value: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"},
+		}}},
+	}
+	if err := oracleSSLCipherCACompatible(bad); err == nil {
+		t.Error("ECDSA cipher on RSA CA must be rejected")
 	}
 }

services/rds/credentials.go

@@ -127,12 +127,14 @@ func (u *RDSCredentialUtils) getCredentials(i *RDSInstance, password string) (ma
 
 // oracleCredentials builds the Oracle-specific binding payload (WS9 #528, TLS #538).
 // It returns machine-readable connection details for a bound app over TLS/TCPS:
-// the SSL port (2484), a TCPS connect descriptor (uri + jdbcUrl with PROTOCOL=TCPS
-// and SSL_SERVER_CERT_DN), ssl_server_dn_match, and the GovCloud RDS CA bundle URL
-// the client must trust. Like the postgres/mysql plans, the broker returns the
-// instance master credential per binding; the customer creates their own
-// least-privilege in-database users (the intended shared-responsibility boundary).
-// No admin/master marker key is exposed here.
+// the SSL port (2484), a TCPS connect descriptor (uri + jdbcUrl with PROTOCOL=TCPS),
+// ssl_server_dn_match, and the GovCloud RDS CA bundle URL the client must trust.
+// Server identity is verified by the driver against the CA bundle + DN match — the
+// broker does NOT publish a hardcoded cert DN (the RDS cert subject is Amazon-owned
+// and rotates; pinning it would duplicate the driver's own check and break on
+// rotation). Like the postgres/mysql plans, the broker returns the instance master
+// credential per binding; the customer creates their own least-privilege in-database
+// users (the intended shared-responsibility boundary). No admin/master marker key.
 //
 // FAIL-CLOSED (security review): if the TLS SSL port cannot be resolved from the
 // embedded baseline, this returns an error rather than falling back to the
@@ -154,17 +156,14 @@ func oracleCredentials(i *RDSInstance, password, scheme, serviceName string) (ma
 		return nil, errors.New("oracle TLS binding: SSL port is 0, refusing to emit a binding that would claim TLS on a plaintext port")
 	}
 
-	// Server cert DN for RDS Oracle TLS: the RDS-issued cert CN is the endpoint.
-	// Enables ssl_server_dn_match to verify server identity (not just encrypt).
-	certDN := fmt.Sprintf("C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=%s", i.Host)
-
-	// TCPS connect descriptor (URI form) with DN match — EZConnect cannot express
-	// PROTOCOL=TCPS or the cert DN, so we use the full DESCRIPTION form.
+	// TCPS connect descriptor (URI form) — EZConnect cannot express PROTOCOL=TCPS,
+	// so we use the full DESCRIPTION form. Server identity is verified by the
+	// client driver via ssl_server_dn_match + the CA bundle (below); we do not pin
+	// the cert DN here.
 	descriptor := fmt.Sprintf(
 		"(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=%s)(PORT=%d))"+
-			"(CONNECT_DATA=(SID=%s))"+
-			"(SECURITY=(SSL_SERVER_CERT_DN=\"%s\")))",
-		i.Host, sslPort, serviceName, certDN,
+			"(CONNECT_DATA=(SID=%s)))",
+		i.Host, sslPort, serviceName,
 	)
 	uri := fmt.Sprintf("%s://%s:%s@%s", scheme, i.Username, password, descriptor)
 	jdbcURL := fmt.Sprintf("jdbc:oracle:thin:@%s", descriptor)
@@ -183,7 +182,6 @@ func oracleCredentials(i *RDSInstance, password, scheme, serviceName string) (ma
 		"name":                serviceName,
 		"ssl_required":        "true",
 		"ssl_server_dn_match": "true",
-		"ssl_server_cert_dn":  certDN,
 		"ca_cert_bundle_url":  "https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.pem",
 	}, nil
 }

services/rds/credentials_test.go

@@ -110,9 +110,11 @@ func TestGetCredentials(t *testing.T) {
 			password: "fake-pw",
 			// Oracle binding is TLS/TCPS on 2484 with a DESCRIPTION connect string
 			// + DN match + GovCloud CA bundle (#538). Port is the SSL port, not 1521.
+			// No hardcoded cert DN: the driver verifies identity via the CA bundle +
+			// ssl_server_dn_match (DRY review — pg/mysql omit it, DN is Amazon-owned).
 			expectedCreds: map[string]string{
-				"uri":                 `oracle://user-1:fake-pw@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=host)(PORT=2484))(CONNECT_DATA=(SID=ORCL))(SECURITY=(SSL_SERVER_CERT_DN="C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=host")))`,
-				"jdbcUrl":             `jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=host)(PORT=2484))(CONNECT_DATA=(SID=ORCL))(SECURITY=(SSL_SERVER_CERT_DN="C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=host")))`,
+				"uri":                 `oracle://user-1:fake-pw@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=host)(PORT=2484))(CONNECT_DATA=(SID=ORCL)))`,
+				"jdbcUrl":             `jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=host)(PORT=2484))(CONNECT_DATA=(SID=ORCL)))`,
 				"username":            "user-1",
 				"password":            "fake-pw",
 				"host":                "host",
@@ -124,7 +126,6 @@ func TestGetCredentials(t *testing.T) {
 				"name":                "ORCL",
 				"ssl_required":        "true",
 				"ssl_server_dn_match": "true",
-				"ssl_server_cert_dn":  "C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=host",
 				"ca_cert_bundle_url":  "https://truststore.pki.us-gov-west-1.rds.amazonaws.com/global/global-bundle.pem",
 			},
 		},