This architecture diagram shows a single Oracle Cloud Infrastructure (OCI) regional architecture with multiple data domains each in their own compartment.

Customer premises equipment (CPE) and enterprise applications, such as customer relationship management (CRM) and core banking, communicate with the OCI region by using Site-to-Site VPN or Oracle Cloud Infrastructure FastConnect and a dynamic routing gateway. Internet users communicate with the OCI region by using an internet gateway.

The following services and features are provided for the region by the Oracle Services Network:

• Oracle Cloud Infrastructure Generative AI
• Oracle Cloud Infrastructure Document Understanding
• Oracle Cloud Infrastructure Object Storage
• Oracle Cloud Infrastructure Data Catalog (in a shared compartment)

For simplicity, the region details the following compartments, but you can expand the number of compartments as necessary for a particular use case.

• Hub compartment: Provides a single Hub virtual cloud network (VCN) with Oracle Cloud Infrastructure Web Application Firewall and the following gateways:
  • Internet gateway: Provides communications between public subnets and internet hosts.
  • Service gateway: Allows the VCN to communicate with services such as object storage over the Oracle network fabric without traversing the internet.
  • Dynamic routing gateway (DRG): Provides private connectivity between on-premises networks and VCNs by using Site-to-Site VPN or FastConnect. In this architecture, the DRG routes traffic to the VCNs in the different compartments.

  The Hub VCN has a public subnet (192.0.2.1/28) with a security list and route table and includes public and standby load balancers to distribute incoming traffic.

• Domain A - Customer Compartment: Provides a single VCN with the following gateways:
  • Network address translation (NAT) gateway: Enables private resources in a VCN to access hosts on the internet, without exposing those resources to incoming internet connections.
  • Service gateway: Allows the VCN to communicate with services such as object storage over the Oracle network fabric without traversing the internet.
  The Domain A - Customer Compartment VCN has 3 private subnets, each with its own security list and route table.

  • Application (private subnet 10.1.10.1/28): Provides an Oracle Analytics Cloud instance.
  • Mid-tier (private subnet 10.1.20.1/28): Provides Oracle Cloud Infrastructure Data Integration and Oracle Cloud Infrastructure Data Flow instances.
  • Data (private subnet 10.1.30.1/28): Provides an Oracle Autonomous Data Warehouse instance.
• Domain C - Risk Compartment: Provides a single VCN with the following gateways:
  • Network address translation (NAT) gateway: Enables private resources in a VCN to access hosts on the internet, without exposing those resources to incoming internet connections.
  • Service gateway: Allows the VCN to communicate with services such as object storage over the Oracle network fabric without traversing the internet.
  The Domain C - Risk Compartment VCN has 3 private subnets, each with its own security list and route table.

  • Application (private subnet 10.3.10.1/28): Shown as empty for this use case.
  • Mid-tier (private subnet 10.3.20.1/28): Provides an Oracle Cloud Infrastructure Data Science instance.
  • Data (private subnet 10.3.30.1/28): Provides an Oracle Autonomous Data Warehouse instance. The Autonomous Data Warehouse instances in the different compartments can communicate with each other.
• Domain N: This is a represtative compartment with a similar topolgy to the other domain compartments: a single VCN with NAT and Serice gateways, and three private subnets.