LAB 38 ‐ Service Gateway: Private Access to Supported OCI Public Services - gautam-amitesh/OCI GitHub Wiki

OCI has native public services whose native endpoints (network destinations) reside outside customer VCNs and have publicly routable IP addresses by default. Some examples of OCI public services are Object Storage and Archive Storage. Therefore, to access Object Storage, you need either public internet access (Internet/NAT Gateway) or a Service Gateway.

A Service Gateway in OCI is a regional component attached to a single VCN that enables resources in private subnets to privately access supported OCI public services without exposing traffic to the public internet. It does not require public IP addresses, NAT Gateways, or Internet Gateways to reach Oracle services because it allows traffic to travel over the Oracle Cloud network fabric. Additionally, only resources within the VCN can initiate communication with the service endpoints, while the external services cannot initiate connections back to the VCN.

Create Service Gateway

  1. Navigation

    Navigation menu > Networking > Virtual cloud networks > Spoke VCN > Gateways > Service Gateways

  2. Click Create Service Gateway

  3. Enter Name, select network-compartment, select OCI IAD Object Storage Service for accessing only Object Storage, and final click Create Service Gateway

Create Route Rules

  1. Navigation

    Navigation menu > Networking > Virtual cloud networks > Spoke VCN > Routing > RT-spoke_vcn-manual > Route Rules

  2. Click Add Route Rules

  3. Select Service Gateway in Target Type

  4. Select OCI IAD Object Storage in Destination Service, select Target Service Gateway Compartment & Target Service Gateway, and finally click Add Route Rules

Allow Egress Rule

  1. Navigation

    Navigation menu > Networking > Virtual cloud networks > Spoke VCN > Security > Security Lists > SL-private_subnet-01-spoke_vcn-manual > Security Rules > Egress Rules

  2. I have already allowed outbound traffic to 0.0.0.0/0 using All Protocols

OCI-CLI Installation & Configuration

  1. Install python3 & python3-pip if not already installed

    # Verification
python --version
python3 -m pip --version

# Installation
sudo dnf install python3 python3-pip -y

  2. Install oci-cli from pip

    # Installation
python3 -m pip install oci-cli --upgrade

# Verification
oci --version

  3. OCI-CLI Configuration file setup`

    oci setup config

Setup API Key in OCI Console

  1. Navigation

    Profile > Identity domain: Default > User management > select user (eg. [email protected]) > API keys

  2. Choose Paste a public key, navigate to the terminal, copy paste the content of /home/opc/.oci/oci_api_key_public.pem file, and click Add

  3. Match your fingerprint shown here and click Close and now we are ready to upload objects in the bucket

Upload Objects to Bucket using OCI-CLI via Service Gateway

  1. Delete the NAT Gateway to validate that objects can be uploaded to the bucket using only the Service Gateway, since the reverse scenario is possible.

  2. Create compressed and archived file to test upload

    # Create Directory
mkdir scripts

# Create Script Files
touch scripts/script01.sh scripts/script02.sh

# Verify Creation
ls -lrth scripts/

# Create Compressed Archive
tar -cjvf scripts_20261009.tar.bz2 scripts

# Verify Creation
ls -lrth

  3. Run OCI-CLI command to upload this archive file to OCI bucket

    oci os object put -bn <bucket-name> --file <archive-name>

  4. Verify object upload in bucket via OCI Console