Automatic rotation of APEX/ORDS infrastucure passwords

We know that when we configure ORDS to support APEX a number of database accounts get created, namely;

APEX_LISTENER

APEX_PUBLIC_USER

APEX_REST_PUBLIC_USER

ORDS_PUBLIC_USER

Each of the above users has a corresponding XML file in the conf folder where ORDS in installed

Theses are named

your_db_instance.xml

your_db_instance_al.xml

your_db_instance_pu.xml

your_db_instance_rt.xml

In each of the XML files the DB user and their passwords are held (passwords prefixed with an ! are hashed once ORDS is restarted). All good so far.

Good security practice means we should regularly rotate or change passwords (my organisation is both ISO27001 and Cyber Essential Plus certified). At present this is a faff as we 3 servers hosing 5 PDB’s in which APEX is installed, having to regularly change the DB passwords (easy not I have a rule governed method for doing so in a JOB triggered package on a monthly basis) BUT modifying 20 xml files across 3 servers is lets face it is a faff and prone to human error.