How can I resolve ORA-04088 error messages on my Amazon RDS for Oracle DB instance?

Resolution

Amazon RDS for Oracle is a managed service. This means that there are certain actions that you can't perform. For example, SYS, SYSTEM, and other administrative accounts supplied by Oracle aren't accessible to you. You also can't perform DDL or GRANT operations on their related objects.

Amazon RDS for Oracle has built-in DDL and GRANT triggers under the RDSADMIN schema. These triggers are invoked when any restricted DDL, GRANT statements, or protected operations occur on the RDS for Oracle DB instance. SYS, SYSTEM, RDSADMIN, RDS_DATAGUARD, RDSSEC, and DBSFWUSER are Amazon RDS for Oracle protected schema.

ORA-04088 is a runtime error that occurs in an Oracle database when a specific trigger runs. You might see an ORA-04088 error if you try to do the following actions:

• Run a custom trigger.
• Run an operation that isn't supported on Amazon RDS for Oracle. For example, you can't create a tablespace with a datafile named identifier. Amazon RDS supports only Oracle managed files. Also, you can't create directories with custom paths. For more information, see Performing common database tasks for Oracle DB instances.
• Run a DDL on Amazon RDS for Oracle protected schema objects. This includes table drops and modification of public synonyms for objects in protected schemas.
• Perform an import operation from a dump that creates or modifies database objects into an Amazon RDS for Oracle protected schema.
• Use the FULL=Y to run a data pump import.
• Use a data pump dump to perform an import operation.
• Run a GRANT command on Amazon RDS for Oracle. This command is restricted for certain privileges and roles. For example, you can't grant privileges such as ALTER DATABASE, ALTER SYSTEM, GRANT ANY PRIVILEGE, DROP ANY DIRECTORY, GRANT ANY ROLE, or CREATE ANY DIRECTORY. Also, you can't grant the RDS_MASTER_ROLE to your Amazon RDS for Oracle users or roles.
• Modify the audit policy or DROP/ALTER audit tablespace AUDIT_TBS when Database Activity Streams (DAS) are turned on.

Investigate and resolve an ORA-04088 error

Use the following troubleshooting steps to investigate and resolve this error.

Resolve errors caused by custom triggers

If the error is caused by a custom trigger that you created, check the related line number followed by ORA-06512 error message. This information indicates whether the trigger failed to operate. To determine the cause, review the code of the custom trigger, and then remediate accordingly.

Resolve errors that occur during data pump import

If you get an ORA-04088 error during the data pump dump import operation, then review the following best practices:

• Don't import in full mode (FULL=Y). Use schema or table mode to import specific schemas and objects. AWS doesn't support the import of objects into Amazon RDS for Oracle protected schema. Instead, use remap to import objects to another schema.
• Don't import dump files that were created with the Oracle Data Pump export parameters TRANSPORT_TABLESPACES, TRANSPORTABLE, or TRANSPORT_FULL_CHECK. RDS for Oracle DB instances don't support the import of these dump files. Instead, use the Oracle transportable tablespaces feature to copy a set of tablespaces from self managed Oracle database to the RDS for Oracle DB instance.
• Don't import dump files that contain Oracle Scheduler objects in SYS, SYSTEM, RDSADMIN, RDSSEC, and RDS_DATAGUARD. See Oracle Data Pump best practices for guidance on how to import objects with Oracle Data Pump.

For more information, review the Limitations for Oracle DBA privileges.