Accessing OCI public services via private network

Introduction

When you running your workloads on any public cloud, protecting your network, data, instance from prying eyes and hands is one of the most important things.

But whenever you need to access public services offered by a cloud, one has to go through the internet. When your data is going through the internet, your network/instance(if not using NAT) and data are exposed to the public.

Is there a way to access public services offered by a public cloud safely, securely and with the same performance and high availability?

So if you are using Oracle Cloud Infrastructure(OCI), look no further, your answer is Service Access Gateway(SGW).

OCI users can access all these services directly from their Virtual Cloud Network(VCN) with private Subnet without any NAT, IGW by using SGW(No need to go to the internet). All traffic for these services is routed through OCI's internal network, thus protecting your data/network/instance.

How to set up an SGW?

This section explains step by step on how to create an SGW and configure it to access the OCI services from your private subnet.

1. Let's create a VCN.

Goto Networking->Virtual Cloud Networks and click on Create Virtual Cloud Network
Provide a name, select Create Virtual Cloud Network only,  CIDR block and click create.

2. Create a Private Subnet

Click on Create Subnet, provide a name, select Regional, CIDR block, and select the default route table and click on create

3. Create a Service Gateway

Click on Service Gateways from the left menu and click on Create Service Gateway. Provide a name and in services select "All Services in Oracle Services Network". If you want to only access Object storage via SGW please select "OCI Object Storage". In this example lets select "All Services in Oracle Services Network" which gives private access to all these services. Click on Create.

It's that simple. So lets test if we can access any OCI public services via our Private subnet.

4. Let's add a Route rule to tell VCN to send the traffic to SGW.

Click on Route Tables from the left menu and click on "Default Route Table for Test-SGW-VCN" default route table. Click on "Add Route Rules" and from drop-down select "Service Gateway" since we want access to All services, lets select "All Services in Oracle Services Network" for destination service. Select newly created SGW for "Target Service Gateway"

That's it, now you can access all these services from the newly created Private subnet.

PS: This is a personal blog. Any comments and questions are welcome.