Note:

This tutorial requires access to Oracle Cloud. To sign up for a free account, see Get started with Oracle Cloud Infrastructure Free Tier.
It uses example values for Oracle Cloud Infrastructure credentials, tenancy, and compartments. When completing your lab, substitute these values with ones specific to your cloud environment.

Use Service Gateway

Introduction

If you’re a typical Oracle Cloud Infrastructure customer, you may have resources in your virtual cloud network (VCN) that need to access the Oracle Cloud Infrastructure Object Storage service, which has publicly addressable endpoints. Until now, you could use either public subnets or a NAT instance, with an internet gateway in your VCN to access the service. However, you might not have wanted to use these options because of privacy, security, or operational concerns.

Service Gateway alleviates the preceding concerns by enabling the following functions:

Private connectivity between your VCNs and Object Storage: You can add a service gateway to a VCN and use the VCN’s private address space to access Object Storage without exposing the instances to the public internet. You don’t need a public subnet, NAT instance, or internet gateway in your VCN.
Enhanced security for your Object Storage buckets: You can limit access to Object Storage buckets from an authorized VCN or from a specific range of IP addresses within the subnet. You can add conditional references to VCN and IP addresses in IAM policies, which can only be satisfied when you initiate connections through a service gateway.

Key Points

We recommend using Chrome or Edge as the broswer. Also set your browser zoom to 80%.

Mac OS Users should use ctrl+C / ctrl+V to copy and paste inside OCI Console.
Login credentials are provided later in the guide (scroll down). Every User MUST keep these credentials handy.

Note: Screenshots may be different than the actual UI.

Prerequisites

Oracle Cloud Infrastructure account credentials (user, password, tenant, and compartment).
OCI Training
Familiarity with OCI console
Overview of Networking
Familiarity with Compartment
Connecting to a compute instance

Sign in to Oracle Cloud Infrastructure Console using your cloud tenant name, user name, and password.
From the OCI services menu, click Object Storage.
Choose your compartment under List Scope in the left navigation pane.
Click Create Bucket and fill out the dialog box:
- Bucket Name: Provide a name
- Storage Tier: STANDARD
- Encryption: ENCRYPT USING ORACLE-MANAGED KEYS
Click Create Bucket.
Click the Apps icon in the toolbar and select Git-Bash.

Alternatively, open a terminal window to run Git commands.
Change the directory to the Downloads folder. Enter command:
```
$ cd /c/Users/PhotonUser/Downloads/
```
Create a sample file. Enter command:
```
touch samplefile
```
This should create a file with the name “samplefile” in the Downloads folder.
Switch to the OCI Console window and click the bucket name.

Hint: You can swap between the OCI Console window and any other application (for example, git-bash) by clicking Switch Window.
The bucket detail window should be visible. Click Upload Object.
Click Upload Object. Fill out the dialog box:
- OBJECT NAME PREFIX: Provide a prefix (optional)
- CHOOSE FILES FROM YOUR COMPUTER: Click Select File and then browse to the location where ‘Sample File’ was created
Select the file, then click Upload Object in the dialog box.

The file should be visible under Objects.
From the OCI services menu, click Virtual Cloud Networks under Networking.

Select your compartment from the drop down menu on left part of the screen under Networking and click Start VCN Wizard.

Note: Ensure that the correct compartment is selected under COMPARTMENT list.
Click VCN with Internet Connectivity and click Start Workflow.
Fill out the dialog box and click Next:
- VCN NAME: Provide a name
- COMPARTMENT: Ensure your compartment is selected
- VCN CIDR BLOCK: Provide a CIDR block (10.0.0.0/16)
- PUBLIC SUBNET CIDR BLOCK: Provide a CIDR block (10.0.1.0/24)
- PRIVATE SUBNET CIDR BLOCK: Provide a CIDR block (10.0.2.0/24)
Verify all the information and click Create.

This will create a VCN with following components: VCN, Public subnet, Private subnet, Internet gateway (IG), NAT gateway (NAT), and Service gateway (SG).
Click View Virtual Cloud Network to display your VCN details.
Click Create Subnet. Fill out the dialog box:
- Name: Enter a name
- Subnet Type: Regional
- CIDR Block: Enter 10.0.5.0/24
- Route Table: Select the Default Route Table
Note: For Production deployment, we strongly recommend creating a seperate route table.
- Subnet access: select Private Subnet
- DHCP Options: Select the default
- Security Lists: Select the Default Security List
Note: For Production deployment, we strongly recommend creating a seperate security list.
Leave all other options as default and click Create Subnet.

Create SSH Keys, Create Two Compute Instances with OCI CLI Pre Installed

Click the Apps icon in the toolbar and select Git-Bash.

Alternatively, open a terminal window to run Git commands.
Enter command:
```
ssh-keygen
```
Hint: You can swap between the OCI Console window, git-bash sessions, and any other application (Notepad, etc.) by clicking the Switch Window icon.
Press Enter when asked for ‘Enter File in which to save the key’, ‘Created Directory, ‘Enter passphrase’, and ‘Enter Passphrase again.
You should now have the public and private keys:

/C/Users/ PhotonUser/.ssh/id_rsa (Private Key)

/C/Users/PhotonUser/.ssh/id_rsa.pub (Public Key)

Note: id_rsa.pub will be used to create the compute instance and id_rsa to connect via SSH into the compute instance.

Hint: Enter command:
```
cd /C/Users/PhotonUser/.ssh (No Spaces)
```
and then:
```
ls 
```
to verify that the two files exist.
In git-bash, enter command:
```
cat /C/Users/PhotonUser/.ssh/id_rsa.pub
```
Highlight the key and copy.
Click the Apps icon, launch Notepad, and paste the key in Notepad (as backup).
Switch to the OCI Console. From the OCI services menu, click Instances under Compute.
Click Create Instance. Fill out the dialog box:
- Name your instance: Enter a name
- Choose an operating system or image source: Click Change Image Source. In the new window, click Oracle Images and choose Oracle Cloud Developer Image. Scroll down, accept the agreement, and click Select Image.
- Availability Domain: Select availability domain
- Instance Type: Select Virtual Machine
- Instance Shape: Select VM shape
Under Configure Networking
- Virtual cloud network compartment: Select your compartment
- Virtual cloud network: Choose the VCN
- Subnet Compartment: Choose your compartment
- Subnet: Choose the Public Subnet under Public Subnets
- Use network security groups to control traffic: Leave un-checked
- Assign a public IP address: Check this option
- Boot Volume: Leave the default
- Add SSH Keys: Choose ‘Paste SSH Keys’ and paste the Public Key saved earlier.
Click Create.
Note down the Public IP address of compute instance.
Create a second compute instance following steps previsouly outlined. Click Instances under Compute.
Click Create Instance. Fill out the dialog box:
- Name: Enter a name
- Image Operating System: Click Change Image Source. In the new window, click Oracle Images, and choose Oracle Cloud Developer Image. Scroll down, accept the agreement and click Select Image.
- Availability Domain: Select availability domain
- Instance Type: Select Virtual Machine
- Instance Shape: Select VM shape
Under Configure Networking
- Virtual cloud network compartment: Select your compartment
- Virtual cloud network: Choose the VCN
- Subnet Compartment: Choose your compartment
- Subnet: Choose the Private Subnet under Private Subnets
- Use network security groups to control traffic: Leave un-checked
- Boot Volume: Leave the default
- Add SSH Keys: Choose ‘Paste SSH Keys’ and paste the Public Key saved earlier
Click Create.

Note: If a ‘Service limit’ error is displayed, choose a different shape such as VM.Standard.E2.2 OR VM.Standard2.2.
Once the instance is in running state, click Instance name and note down its Private IP address.
In order to SSH into private instance, we will use the SSH proxy command. This command allows us to “tunnel” through the bastion host to our private instance.

Storing private SSH keys on a public server such as a Bastion host (first compute instance) is not recommended.
Ensure that you have both the Public IP of the first compute and Private IP of the second compute. In the git-bash window, ensure that you are in the /C/Users/PhotonUser/.ssh directory. Enter command:
```
bash 
ssh -t -o ProxyCommand='ssh -i <SSH_Private_Key_Name> opc@<FIRST_COMPUTE_PUBLIC_IP> -W %h:%p %r' -i <SSH_Private_Key_Name> opc@<SECOND_COMPUTE_PRIVATE_IP>   
```
Enter Yes at the security prompt.
Check the oci CLI installed version. Enter command:
```
oci -v
```
Note: The version should be minimum 2.4.2X.
Next we will configure OCI CLI. Enter command:
```
oci setup config
```
Accept the default directory location.

For user OCI, switch to the OCI Console window. Click the Human icon and then your user name. In the user details page, click copy to copy the OCID. Also note down your region name as shown in the OCI Console window. Paste the OCID in the SSH session.
Repeat the step to find the tenancy OCID (Human icon followed by clicking the tenancy name). Paste the Tenancy OCID in the SSH session to compute instance followed by providing your region name (for example, us-ashburn-1, us-phoneix-1).
When asked for Do you want to generate a new RSA key pair?, answer Y. For the rest of the question, accept the default by pressing Enter.

Upload API Keys and Verify Functionality

oci setup config also generated an API key. We will need to upload this API key into our OCI account for authentication of API calls. Switch to SSH session to compute instance to display the content of the API key. Enter command:
```
cat ~/.oci/oci_api_key_public.pem
```
Highlight and copy the content from the SSH session. Switch to OCI Console, click the Human icon followed by your user name. In the user details page, click Add Public Key. In the dialg box, paste the public key content and click Add.
A new finger print will be generated. Switch to the git-bash window and enter command:
```
cat /home/opc/.oci/config 
```
Compare the finger print in the output of the config file to the one in the OCI console window and make sure they match.

We will now upload an object to object storage and access it from the second compute instance. This download will use the Public IP of the compute instance.
Switch back to the OCI Console window and navigate to your object storage bucket details page. Note down the name space and object storage name.
Switch to git-bash window (ssh session to second compute instance) and download samplefile. Enter command:
```
`bash oci os object get --namespace <NAME_SPACE> --bucket-name <BUCKET_NAME> --name samplefile --file ./
```
Hint: In this example, the command will be: oci os object get --namespace us_training --bucket-name Service-Gateway-Bucket --name samplefile --file ./samplefile
No output will be displayed and no file will be downloaded. Enter Ctrl+C to terminate the command. Enter command:
```
ls
```
and verify that samplefile was not downloaded.

Since there is no Public IP on the second compute instance, it cannot access object storage. Next, we will initialize the route table and re-download the file.
Switch to OCI Console. From the OCI services menu, click Virtual Cloud Networks under Networking. Locate your VCN and click the VCN name to display VCN details.
Click Route tables and click Default Route Table for <VCN_NAME>.
Click Add Route Rules. Fill out the dialog box:
- TARGET TYPE: Service Gateway
- DESTINATION SERVICE: OCI IAD-ObjectStorage
- COMPARTMENT: Choose your compartment
- TARGET SERVICE GATEWAY: Choose the service Gateway created earlier
Click Add Route Rules. A new route entry should be created.
In Your VCN, click Security Lists, then click Default Security List for <VCN_NAME>. Click Add Egress Rules.
Add following Egress rule; Ensure to leave the STATELESS flag un-checked.
- DESTINATION TYPE: Service
- DESTINATION SERVICE: OCI IAD Object Storage
- SOURCE PORT RANGE: ALL
- DESTINATION PORT RANGE: ALL
Click Add Egress Rules.
Switch to the git-bash window (with SSH to the second compute instance).

Re-enter the download command:

bash oci os object get --namespace <NAME_SPACE> --bucket-name <BUCKET_NAME> --name samplefile --file ./

OCI OS Object Get Command

Using Service Gateway, the compute instance was able to access Object stored in Object Storage. This was done using the private backbone network of OCI rather than public internet.

Delete the Resources

As practice, you will need to figure out any errors encountered during deletion of resources.

Switch to the OCI Console window.
If your compute instance is not displayed, from the OCI services menu, click Instances under Compute.
Locate the compute instance, click the Action icon, and then click Terminate.
Make sure Permanently delete the attached Boot Volume is checked and click Terminate Instance. Wait for the instance to fully terminate.
Repeat these steps to delete the second compute instance.
From the OCI services menu, click Virtual Cloud Networks under Networking.

A list of all VCNs will appear.
Locate your VCN, click the Action icon, and then click Terminate. Click Delete All in the confirmation window. Click Close once the VCN is deleted.
From the OCI services menu, navigate to OBject Storage. Click your bucket name. Under Objects, your file should be visible. Click the Action icon (3 vertical dots) and click Delete to delete the object.
Once the object is deleted, click Delete to delete the bucket.