LAB 51 ‐ AI ‐ Re‐prepare HUb resources using copilot chat & Agent(Agent optional) - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

OCI Hub-and-Spoke Network Architecture Using Terraform

Overview

This project demonstrates the implementation of a Hub-and-Spoke Network Architecture in Oracle Cloud Infrastructure (OCI) using Terraform.

Initially, only the Spoke VCN was provisioned using Terraform, while the Hub VCN was created manually. Later, the architecture was enhanced and standardized by provisioning both Hub VCN and Spoke VCN through Terraform, making the deployment fully Infrastructure as Code (IaC).

Initial Architecture

Hub VCN (Manual Creation)

Initially, the Hub VCN was created manually from the OCI Console.

Hub VCN Components

  • Hub VCN
  • Internet Gateway
  • Route Table
  • Public Subnet
  • Private Subnet
  • Security Lists

Hub VCN CIDR

10.0.0.0/24

Hub Public Subnet

10.0.0.0/25

Hub Private Subnet

10.0.0.128/25

Spoke VCN (Terraform Managed)

The Spoke VCN was initially provisioned using Terraform.

Spoke Components

  • Spoke VCN
  • Route Table
  • Security List
  • Single Subnet

Spoke VCN CIDR

10.1.0.0/24

Spoke Subnet

10.1.0.0/25

Current Architecture

The environment has now been enhanced so that both Hub and Spoke networks are managed through Terraform.

This provides:

  • Consistent deployments
  • Version control through GitHub
  • Repeatable infrastructure
  • Easy environment recreation
  • Infrastructure as Code best practices

Hub VCN (Terraform Managed)

The Hub VCN now contains:

VCN

Hub VCN
CIDR: 10.0.0.0/24

Public Subnet

Used for:

  • Bastion Host
  • Public-facing services
  • Internet access resources
CIDR: 10.0.0.0/25

Private Subnet

Used for:

  • Application Servers
  • Backend Services
  • Internal Resources
CIDR: 10.0.0.128/25

Public Security List

Allows:

  • SSH (22)
  • HTTP (80)
  • HTTPS (443)

Example:

Ingress:
22/TCP
80/TCP
443/TCP

Private Security List

Allows only internal communication.

Example:

Ingress:
10.0.0.0/24
10.1.0.0/24

Route Table

Configured for:

  • Internet Gateway
  • Local VCN communication
  • Future DRG connectivity

Spoke VCN (Terraform Managed)

The Spoke network is intentionally kept simple.

VCN

Spoke VCN
CIDR: 10.1.0.0/24

Single Application Subnet

Used for application workloads.

CIDR: 10.1.0.0/25

Security List

Configured for application traffic.

Example:

SSH (22)
HTTP (80)
HTTPS (443)

Route Table

Used for:

  • Local routing
  • Future Hub communication through DRG

Why Hub Has Two Subnets and Spoke Has One Subnet

Hub VCN

The Hub acts as the central network.

Therefore it requires:

  • Public Subnet
  • Private Subnet
  • Public Security List
  • Private Security List

This allows separation of public-facing and internal resources.

Spoke VCN

The Spoke is designed to host application workloads.

To keep the design simple and cost-effective:

  • One Security List
  • One Subnet

were sufficient for current requirements.

Additional subnets can be added later as the environment grows.

Terraform Project Structure

terraform/
│
├── network.tf
├── variables.tf
├── outputs.tf
├── terraform.tfvars
│
└── modules/
    │
    ├── hub_network_module/
    │   │
    │   ├── vcn.tf
    │   ├── internet_gateway.tf
    │   ├── route_table.tf
    │   ├── public_subnet.tf
    │   ├── private_subnet.tf
    │   ├── public_security_list.tf
    │   ├── private_security_list.tf
    │   ├── variables.tf
    │   └── outputs.tf
    │
    └── spoke_network_module/
        │
        ├── vcn.tf
        ├── route_table.tf
        ├── subnet.tf
        ├── security_list.tf
        ├── variables.tf
        └── outputs.tf

The Hub Network Module is designed as the central network layer of the architecture. The Spoke Network Module is designed to host application workloads.

Architecture Difference

Hub VCN

The Hub VCN contains:

  • Public Subnet
  • Private Subnet
  • Public Security List
  • Private Security List

Reason:

The Hub acts as a centralized networking layer and may host:

  • Bastion Hosts
  • Shared Services
  • Future DRG Connectivity
  • Internet-facing Resources

Spoke VCN

The Spoke VCN contains:

  • Single Application Subnet
  • Single Security List

Reason:

The Spoke is intended only for application workloads and currently does not require subnet segregation.

This keeps the design simple and easy to manage.

Future expansion can include:

  • Additional Private Subnets
  • NSGs
  • Load Balancers
  • Application Tiers

# Benefits of Terraform-Based Hub-and-Spoke Design

- Infrastructure as Code (IaC)
- Version Controlled via GitHub
- Reusable Modules
- Faster Deployment
- Easy Disaster Recovery
- Consistent Configuration Across Environments
- Reduced Manual Errors
- Simplified Network Management

Final Architecture Summary

Component Hub VCN Spoke VCN
Terraform Managed Yes Yes
Public Subnet Yes No
Private Subnet Yes Yes (Application Subnet)
Public Security List Yes No
Private Security List Yes No
Security List No Yes
Route Table Yes Yes
VCN Yes Yes

Conclusion

The environment evolved from a partially automated deployment where only the Spoke VCN was managed through Terraform to a fully automated Hub-and-Spoke architecture. Both Hub and Spoke networks are now provisioned and maintained through Terraform modules, providing a scalable, repeatable, and production-ready OCI networking foundation.