Service Gateway provides private connectivity from a VCN to Oracle services, allowing instances in private subnets to access public oracle services like Object Storage without requiring a public IP, Internet Gateway, or NAT Gateway. With a Service Gateway, instances in a Private Subnet can access services such as Object Storage while using only private IP addresses.

The traffic remains on Oracle's private network and never traverses the Internet, which improves both security and performance.

In many organizations, application servers are deployed in a Private Subnet and do not have Public IP addresses.

These servers may need to:

• Store application backups in Object Storage
• Download files from Object Storage
• Access supported Oracle services securely

Without a Service Gateway, traffic would need to go through the Internet using an Internet Gateway or NAT Gateway.

A Service Gateway provides a private and secure path to Oracle services. :contentReference[oaicite:1]{index=1}

Consider the following scenario:

• An Application Server is deployed in a Private Subnet.
• Daily application backups need to be stored in OCI Object Storage.
• The server does not have a Public IP.

Instead of sending backup traffic through the Internet, a Service Gateway is configured.

Application Server
       |
       v
Service Gateway
       |
       v
Object Storage

The backup data travels entirely within Oracle's network and never passes through the public Internet. :contentReference[oaicite:2]{index=2}

• Private access to Oracle services
• No Public IP required
• Traffic does not traverse the Internet
• Improved security
• Commonly used with Object Storage backups
• Can be used by resources in Private Subnets

:contentReference[oaicite:3]{index=3}

:contentReference[oaicite:4]{index=4}

                    OCI REGION

        +--------------------------+
        |      Object Storage      |
        +------------+-------------+
                     ^
                     |
             Service Gateway
                     ^
                     |
      +----------------------------+
      |     Private Subnet         |
      |                            |
      |  Application Server        |
      |  (No Public IP)            |
      +----------------------------+

Traffic remains within Oracle Network
No Internet Exposure

• Object Storage backups
• Log archival to Object Storage
• Secure access to Oracle services from Private Subnets
• Enterprise environments where Internet exposure must be minimized

create jump server and connect private instance

service gateway has been created now in spoke vcn

now adding service gateway in spoke-dev-route-table

create the dynamic group and added private instance OCID

dynamic group has been created now

now Create a policy that grants Object Storage access to the Dynamic Group.

give the compartment name where your bucket is

Allow dynamic-group DG-ObjectStorage-Test to read objects in compartment <Compartment-Name>

This policy allows instances in the Dynamic Group to read Object Storage objects.

install oci cli without nat gateway

cat /etc/os-release

sudo dnf -y install oraclelinux-developer-release-el9

sudo dnf install -y python39-oci-cli

oci --version

oci os ns get --auth instance_principal

oci os object list --auth instance_principal --bucket-name demo-service-gw-bucket --namespace-name idmubuehmgd8

now download the file

oci os object get \
--auth instance_principal \
--bucket-name demo-service-gw-bucket \
--namespace-name idmubuehmgd8 \
--name sample.txt \
--file sample.txt

cat sample.txt

To verify that a Private Instance can access Oracle Object Storage through a Service Gateway without requiring Internet access or a NAT Gateway.

• Created a Compute Instance in the Private Subnet of the Spoke VCN.

• Connected to the Private Instance through the Jump Server.

• Created a Service Gateway in the Spoke VCN.
• Configured the required route to allow traffic to Oracle Services through the Service Gateway.

• Created a Dynamic Group.
• Added the Private Instance to the Dynamic Group using its Instance OCID as the matching rule.

• Created an IAM Policy to allow the Dynamic Group to access Object Storage.

• Installed OCI CLI on the Private Instance without using a NAT Gateway.

• Used Instance Principal authentication to verify access to OCI services.

  oci os ns get --auth instance_principal

• Successfully retrieved the Object Storage namespace.

• Accessed the Object Storage bucket from the Private Instance using Instance Principal authentication.

• Verified that sample.txt was available in the bucket.

  oci os object list
  --auth instance_principal
  --bucket-name demo-service-gw-bucket
  --namespace-name

• Downloaded sample.txt from the Object Storage bucket to the Private Instance.

  oci os object get
  --auth instance_principal
  --bucket-name demo-service-gw-bucket
  --namespace-name
  --name sample.txt
  --file sample.txt

• Verified the downloaded file and its content:

  ls -l sample.txt cat sample.txt

The Private Instance successfully accessed the Object Storage bucket and sample.txt through the Service Gateway using Instance Principal authentication, Dynamic Group, and IAM Policy, without requiring Internet access or a NAT Gateway.

Spoke VCN
     |
+----------------+
| Private        |
| Instance       |
+----------------+
     |
     | Instance Principal
     v
+----------------+
| Dynamic Group  |
+----------------+
     |
     | IAM Policy
     v
+----------------+
| Object Storage |
+----------------+
     ^
     |
+----------------+
| Service        |
| Gateway        |
+----------------+
     |
     v
Oracle Services Network

• Dynamic Group + IAM Policy provides the required authorization for the Private Instance to access Object Storage.
• Instance Principal allows the Private Instance to authenticate to OCI services without using API keys or an OCI configuration file.
• Service Gateway provides private connectivity to Oracle services from the VCN.
• The Private Instance can access Object Storage without Internet access or a NAT Gateway.
• The successful access of sample.txt from the Private Instance confirms that the complete Dynamic Group + IAM Policy + Instance Principal + Service Gateway setup is working successfully.