dbms_datapump on AWS RDS: ORA-28031: maximum of 150 enabled roles exceeded

Question

Scenario

AWS RDS Oracle DB instance master user runs export full database with dbms_datapump.

This error appears after all the data gets copied out:

ORA-28031: maximum of 150 enabled roles exceeded

Backtrace

ORA-39126: Worker unexpected fatal error in KUPW$WORKER.UNLOAD_DATA [TABLE_DATA:"DBAMASTER"."EXP_FULL_PROD_J1_00020_BJWA"]
ORA-28031: maximum of 150 enabled roles exceeded
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 95
ORA-06512: at "SYS.KUPW$WORKER", line 12372
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 95
ORA-06512: at "SYS.DBMS_STATS", line 39159
ORA-06512: at "SYS.DBMS_STATS", line 38447
ORA-06512: at "SYS.DBMS_STATS", line 37327
ORA-06512: at "SYS.DBMS_STATS", line 35519
ORA-06512: at "SYS.DBMS_STATS", line 33434
ORA-06512: at "SYS.DBMS_SQLTUNE_INTERNAL", line 161
ORA-06512: at "SYS.DBMS_SQLTUNE_INTERNAL", line 14309
ORA-06512: at "SYS.DBMS_STATS_INTERNAL", line 11124
ORA-06512: at "SYS.DBMS_STATS_INTERNAL", line 11189
ORA-06512: at "SYS.DBMS_STATS", line 33400
ORA-06512: at "SYS.DBMS_STATS", line 35083
ORA-06512: at "SYS.DBMS_STATS", line 37161
ORA-06512: at "SYS.DBMS_STATS", line 38151
ORA-06512: at "SYS.DBMS_STATS", line 38595
ORA-06512: at "SYS.DBMS_STATS", line 39141
ORA-06512: at "SYS.KUPW$WORKER", line 4200
----- PL/SQL Call Stack -----
  object      line  object
  handle    number  name
0xc2394428     32870  package body SYS.KUPW$WORKER.WRITE_ERROR_INFORMATION
0xc2394428     12400  package body SYS.KUPW$WORKER.DETERMINE_FATAL_ERROR
0xc2394428      4617  package body SYS.KUPW$WORKER.UNLOAD_DATA
0xc2394428     13474  package body SYS.KUPW$WORKER.DISPATCH_WORK_ITEMS
0xc2394428      2410  package body SYS.KUPW$WORKER.MAIN
0x9d3502f0         2  anonymous block
KUPW: Method: 1
KUPW: Parallel: 1
KUPW: Creation level: 0
KUPW: Sequence number: 0
BULK COLLECT
BULK COLLECT
KUPW: In procedure BUILD_OBJECT_STRINGS - non-base info
KUPW: In PROCESS_TABLE_DATA_METRICS
DBMS_STATS.GATHER_TABLE_STATS

Answer 1

Cause

The AWS master user has a high number of enabled roles.

Solution

Create a new user with only datapump_exp_full_database role. Use that user to run dbms_datapump.

create user dbaexp
identified by
kfFY4mBu
account unlock;

grant datapump_exp_full_database to dbaexp;
grant read, write on directory DATA_PUMP_DIR to dbaexp;
grant read, write on directory DATA_PUMP_LOGS to dbaexp;
grant read on directory BDUMP to dbaexp;

Comment about the granted directory access

Using dbms_datapump.add_file, you can specify directories for your dumpfile and datapump logs. With rdsadmin.rdsadmin_s3_tasks, you can copy export dump files to s3. Your rdsadmin task logs are in BDUMP. You can use rdsadmin.rds_file_util to read your task logs.