Service Gateway,,

An OCI Service Gateway allows resources in a private subnet to access supported Oracle Cloud Infrastructure (OCI) services without using the public internet.

From an application server in the private subnet, if we need to upload files to Object Storage but we generally don't want its traffic going through the public internet. In that case we use a service gateway. We attach the gateway to the route table, similar to attaching a NAT Gateway.

In case of NAT Gateway the connection flows from:

Private Instance --> NAT Gateway --> Internet

In case of Service Gateway the connection flows from:

Private Instance --> Service Gateway --> Object Storage

An OCI Service Gateway provides private connectivity from resources in a VCN to supported Oracle services (eg: Object Storage) without requiring traffic to traverse the public internet. The private subnet's route table directs traffic destined for Oracle services to the Service Gateway, while security rules control whether that traffic is permitted...

Firstly, Creating Service Gateway..

Burger menu > Networking > Virtual cloud networks > Spoke VCN > Gateways > Service Gateways

Created..

Secondly, Adding Service Gateway into the Route Table...

Burger menu > Networking > Virtual cloud networks > Spoke VCN > Routing > RT-spoke_vcn-manual > Route Rules

Route rule Added...

Now, Main thing Allowing Egress Rule in Security List...

Burger menu > Networking > Virtual cloud networks > Spoke VCN > Security > Security Lists > custom_sl-private-subnet_spoke-vcn > Security Rules > Egress Rules.

Allowing 0.0.0.0/0 Destination using All protocols for Outbound Traffic..

OCI-CLI Installation & Configuration..

Install python3 & python3-pip if not already Installed...

Verification

python --version

python3 -m pip --version

Installation

sudo dnf install python3-pip -y

Installation..

python3 -m pip install oci-cli --upgrade

Verification..

oci --version

OCI-CLI Configuration file setup...

oci setup config

Setup API Key in OCI Console

Profile > Identity domain: Default > User management > select user (eg. [email protected]) > API keys

Choose Paste a public key, navigate to the terminal, copy paste the content..

cat /home/opc/.oci/oci_api_key_public.pem 

Click ADD...

Terminating NAT Gateway...

Deleting the NAT Gateway to validate that objects can be uploaded to the bucket using only the Service Gateway, since the reverse scenario is possible.

Creating compressed and archived file to test upload

Create Directory..

mkdir scripts

Create Script Files..

touch scripts/script01.sh scripts/script02.sh

Verify Creation..

ls -lrth scripts/

Create Compressed Archive..

tar -cjvf scripts_20261009.tar.bz2 scripts

Verify Creation..

ls -lrth

Run OCI-CLI command to upload this archive file to OCI bucket..

oci os object put -bn <bucket-name> --file <archive-name>

Finally Verifying Object Upload in Bucket in OCI Console..

THANKYOU!