Oracle has som annoying rules about passwords that don't seem to be followed by rds.Credentials.from_generated_secret(username="nexcom", exclude_characters="^ %+~`#&*()|[]{}:;,-<>?!'/\\\",="),

fix_in_cdk.py

# Another way to fix this is to let SecretsManager handle it when creating/updating the DatabaseInstance
# The SecretsManager will produce a 30 character string and I’ll leave it as an exercise to the reader to calculate 
# the probability of generating a string that does NOT include at least 3 of the character groups indicated above.

exclude_characters=string.printable
  .replace(string.ascii_letters, "")
  .replace(string.digits, "")
  .replace(string.whitespace, " ")
  .replace('#', "")
  .replace("$", "")
  .replace("_", "")

rds.DatabaseInstance(self, "Oracle",
   engine=rds.DatabaseInstanceEngine.oracle_ ...
   ...
   credentials=rds.Credentials.from_generated_secret(username="admin", exclude_characters=exclude_characters),
   ...

random_oracle_password.py

import string
import random

def random_oracle_password(length):
    assert length > 14
    """ Your Oracle Password must contain at least 15 characters and include 3 of the following:
        - At least one uppercase letter
        - At least one lowercase letter
        - At least one digit
        - At least 1 special character
          - only the following special characters are allowed: # $ _
    """
    characters = list(string.ascii_letters + string.digits + "#$_")
    password = [
             random.choice(string.ascii_uppercase),
             random.choice(string.ascii_lowercase),
             random.choice(string.digits),
             random.choice("#$_")]
    for i in range(length - 4):
        password.append(random.choice(characters))
    random.shuffle(password)
    return "".join(password)