Access to Oracle Services: Service Gateway

1. In the Console, confirm you're viewing the compartment that contains the VCN that you want to add the service gateway to. For information about compartments and access control, see Access Control.
2. Open the navigation menu, click Networking, and then click Virtual cloud networks.
3. Click the VCN you're interested in.
4. On the left side of the page, click Service Gateways.
5. Click Create Service Gateway.

6. Enter the following values:

   • Name: A descriptive name for the service gateway. It doesn't have to be unique. Avoid entering confidential information.
   • Create in compartment: The compartment where you want to create the service gateway, if different from the compartment you're currently working in.
   • Services: Optionally select the service CIDR label you're interested in. If you don't select one now, you can later update the service gateway and add a service CIDR label then. Without at least one service CIDR label enabled for the gateway, no traffic flows through it.
   • Route Table Association: (advanced option) You can associate a specific VCN route table with this gateway. If you associate a route table, afterwards the gateway must always have a route table associated with it. You can modify the rules in the current route table or replace it with another route table.
   • Tags: (advanced option) If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure whether to apply tags, skip this option (you can apply tags later) or ask your administrator.

7. Click Create Service Gateway.

   The service gateway is then created and displayed on the Service Gateways page in the compartment you chose. The gateway allows traffic through it by default. At any time, you can block or allow the traffic through it.

When you configure a service gateway for a particular service CIDR label, you must also create a route rule that specifies that label as the destination and the target as the service gateway. You do this for each subnet that needs to access the gateway.

1. Determine which subnets in your VCN need access to the service gateway.

2. For each of those subnets, update the subnet's route table to include a new rule:

   1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
   2. Click the VCN you're interested in.
   3. Under Resources, click Route Tables.
   4. Click the route table you're interested in.
   5. Click Edit Route Rules.

   6. Click Add Route Rule and enter the following values:

      • Target Type: Service Gateway.
      • Destination Service: The service CIDR label that is enabled for the gateway.
      • Compartment: The compartment where the service gateway is located.
      • Target: The service gateway.
      • Description: An optional description of the rule.
   7. Click Save.

Any subnet traffic with a destination that matches the rule is routed to the service gateway. For more information about setting up route rules, see VCN Route Tables.

Later, if you no longer need the service gateway and want to delete it, you must first delete all the route rules in your VCN that specify the service gateway as the target.

When you configure a service gateway to access a service CIDR label, you must also ensure that the security rules are configured to allow the desired traffic. Your security rules might already allow this traffic, which is why this task is optional. The following procedure assumes you are using security lists to implement your security rules. The procedure describes how to set up a rule that uses the service CIDR label. You do this for each subnet that needs to access the gateway.

1. Determine which subnets in your VCN need to connect to the services you're interested in.

2. Update the security list for each of those subnets to include rules to allow the desired egress or ingress traffic with the particular service:

   1. In the Console, while viewing the VCN you're interested in, click Security Lists.
   2. Click the security list you're interested in.

   3. Click Edit All Rules and create one or more rules, each for the specific type of traffic you want to allow. See the following example for more details.

      Example

      Let's say you want to add a stateful rule that enables egress HTTPS (TCP port 443) traffic from the subnet to both Object Storage and Oracle YUM repos. Here are the basic steps you take when adding a rule:

      1. In the Allow Rules for Egress section, click +Add Rule.
      2. Leave the Stateless check box unselected.
      3. Destination Type: Service.
      4. Destination Service: The service CIDR label that you're interested in. To access both Object Storage and Oracle YUM repos, it's All <region> Services in Oracle Services Network.
      5. IP Protocol: Leave as TCP.
      6. Source Port Range: Leave as All.
      7. Destination Port Range: Enter 443.
      8. Description: An optional description of the rule.
   4. Click Save Security List Rules at the bottom of the dialog box.

For more information about setting up security rules, see Security Rules.

This task is applicable only if you're using a service gateway to access Object Storage. You can optionally create a network source and write an IAM policy to allow only the resources in a specific VCN to write objects to a particular bucket.

• Create a network source to specify the allowed VCN. For information on creating network sources, see Managing Network Sources.
• Create the policy. The following example lets resources in the example ObjectBackup group write objects to an existing bucket called db-backup that resides in a compartment called ABC.

  Allow group ObjectBackup to read buckets in compartment ABC
  
  Allow group ObjectBackup to manage objects in compartment ABC where
     all {target.bucket.name='db-backup', 
          request.networkSource.name='<VCN_NETWORK_SOURCE',
          any {request.permission='OBJECT_CREATE', request.permission='OBJECT_INSPECT'}}

You can specify multiple VCNs by creating and specifying multiple network sources in the policy. The next example has network sources for two VCNs. You might do this if you've set up your on-premises network with private access to Oracle services through a VCN, and you've also set up one or more other VCNs with their own service gateways. For more information, see Overview of On-Premises Network Private Access to Oracle Services.

Allow group ObjectBackup to read buckets in compartment ABC

Allow group ObjectBackup to manage objects in compartment ABC where
   all {target.bucket.name='db-backup', 
        any {request.networkSource.name='<NETWORK_SOURCE_FOR_VCN_1>', request.networkSource.name='<NETWORK_SOURCE_FOR_VCN_2'},
        any {request.permission='OBJECT_CREATE', request.permission='OBJECT_INSPECT'}}

See the instructions in Task 1: Create the service gateway.

To avoid disrupting your Object Storage connections while switching between the OCI <region> Object Storage service CIDR label and All <region> Services in Oracle Services Network, use the following process:

1. Update the service gateway: Remove the existing service CIDR label, and then add the one you want to switch to. You can't enable both labels for the service gateway.
2. Update relevant route rules: For each rule that uses the service gateway as the target, switch the rule's destination service from the existing service CIDR label to the one you want to switch to.
3. Update relevant security rules: Change any security rules that specify the existing service CIDR label to instead use the one you want to switch to. The rules can be in network security groups or security lists.

If you instead delete your existing service gateway and create a new one, your Object Storage connections will be disrupted. Remember that before you can delete a service gateway, you must delete any route rules that specify that gateway as a target.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. Click Service Gateways.
4. For the service gateway you're interested in, click the Actions menu, and then click Edit.
5. Make your changes and click Save.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. Click Service Gateways.

4. For the service gateway you're interested in, click the Actions menu, and then click Block Traffic (or Allow Traffic if you're enabling traffic for the service gateway).

   When the traffic is blocked, the service gateway's icon turns gray, and the label changes to BLOCKED. When the traffic is allowed, the service gateway's icon turns green, and the label changes to AVAILABLE.

You perform this task only if you're implementing an advanced transit routing scenario.

A service gateway can exist without a route table associated with it. However, after you associate a route table with a service gateway, there must always be a route table associated with it. But, you can associate a different route table. You can also edit the table's rules, or delete some or all of the rules.

Prerequisite: The route table must exist and belong to the VCN that the service gateway belongs to.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. Under Resources, click Service Gateways.

4. For the service gateway you're interested in, click the Actions menu, and then click either: 

   • Associate With Route Table: If the service gateway has no route table associated with it yet.
   • Associate Different Route Table: If you're changing which route table is associated with the service gateway.
5. Select the compartment where the route table resides, and select the route table itself.
6. Click Associate.

Prerequisite: The service gateway does not have to block traffic, but there must not be a route table that lists it as a target.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. Click Service Gateways.

4. For the service gateway you're interested in, click the Actions menu, and then click Delete.

5. Confirm when prompted.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. For the service gateway you're interested in, click the Actions menu, and then click View Tags. From there you can view the existing tags, edit them, and apply new ones.

For more information, see Resource Tags.

You can move a service gateway from one compartment to another. When you move a service gateway to a new compartment, inherent policies apply immediately.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. In Resources, click Service Gateways.
4. Find the service gateway in the list, click the the Actions menu, and then click Move Resource.
5. Choose the destination compartment from the list.
6. Click Move Resource.

The service gateway moves to the new compartment immediately. Depending on your permissions, you can select the compartment in the left side menu to view the service gateway.

For more information about using compartments and policies to control access to your cloud network, see Access Control. For general information about compartments, see Managing Compartments.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Click the VCN you're interested in.
3. For the service gateway you're interested in, click the Actions menu, and then click Associate Different Route Table. From there you can change the associated route table for this gateway or associate a route table to a gateway that doesn't already have an associated route table. After a route table is associated to a gateway, the gateway must always have a route table associated with it.

For more information, see Resource Tags.