Skip to main content 首页 创作者 jeremylongshore claude-code-plugins-plus-skills oraclecloud-reference-architecture
oraclecloud-reference-architecture Standard 3-tier OCI reference architecture with VCN, subnets, gateways, load balancer, compute, and Autonomous DB.
Use when designing a new OCI deployment, translating AWS/Azure patterns, or creating Terraform for OCI infrastructure.
Trigger with "oraclecloud architecture", "oci reference design", "oci 3 tier", "oci vpc design".
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill oraclecloud-reference-architecture命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... name oraclecloud-reference-architecture description Standard 3-tier OCI reference architecture with VCN, subnets, gateways, load balancer, compute, and Autonomous DB.
Use when designing a new OCI deployment, translating AWS/Azure patterns, or creating Terraform for OCI infrastructure.
Trigger with "oraclecloud architecture", "oci reference design", "oci 3 tier", "oci vpc design".
allowed-tools Read, Write, Edit, Bash(oci:*), Bash(python3:*), Bash(terraform:*), Grep version 1.7.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> tags ["saas","oraclecloud","oci"] compatibility Designed for Claude Code
Oracle Cloud Reference Architecture
Overview
OCI architecture has more moving parts than AWS or Azure. Where AWS has VPC + subnets + internet gateway, OCI has VCN + regional subnets + Internet Gateway + NAT Gateway + Service Gateway + DRG (Dynamic Routing Gateway) + LPG (Local Peering Gateway) — and getting the routing tables wrong means silent packet drops with no error. This provides the standard 3-tier architecture (web/app/db) with every OCI-specific component wired correctly, plus Terraform code to deploy it.
Purpose: Produce a production-ready 3-tier OCI architecture with correctly configured networking, gateways, security rules, and compute/database tiers — deployable via Terraform.
Prerequisites
Instructions
Step 1: Architecture Overview
┌─────────────────────────── OCI Region (us-ashburn-1) ───────────────────────────┐
│ │
│ ┌────────────────────────── VCN (10.0.0.0/16) ──────────────────────────────┐ │
│ │ │ │
│ │ ┌─── Internet GW ───┐ ┌─── NAT GW ───┐ ┌─── Service GW ───┐ │ │
│ │ └────────┬───────────┘ └──────┬────────┘ └───────┬──────────┘ │ │
│ │ │ │ │ │ │
│ │ ┌────────▼──────────────────────────────────────────────────────────┐ │ │
│ │ │ Public Subnet (10.0.1.0/24) — Web Tier │ │ │
│ │ │ Load Balancer (public) → routes to App Tier │ │ │
│ │ │ Bastion Host (optional) │ │ │
│ │ └──────────────────────┬───────────────────────────────────────────┘ │ │
│ │ │ │ │
│ │ ┌──────────────────────▼───────────────────────────────────────────┐ │ │
│ │ │ Private Subnet (10.0.2.0/24) — App Tier │ │ │
│ │ │ Compute Instances (VM.Standard.E4.Flex) │ │ │
│ │ │ → NAT GW for outbound internet (patching, APIs) │ │ │
│ │ │ → Service GW for OCI services (Object Storage, etc.) │ │ │
│ │ └──────────────────────┬───────────────────────────────────────────┘ │ │
│ │ │ │ │
│ │ ┌──────────────────────▼───────────────────────────────────────────┐ │ │
│ │ │ Private Subnet (10.0.3.0/24) — DB Tier │ │ │
│ │ │ Autonomous Database (ATP or ADW) │ │ │
│ │ │ → Service GW only (no internet access) │ │ │
│ │ └──────────────────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌─── DRG ───┐ ← On-premises or cross-region peering │ │
│ │ └────────────┘ │ │
│ └────────────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────────┘
Step 2: Gateway Types Explained Gateway Purpose Attached To Use Case Internet Gateway Bidirectional internet access Public subnet route table Load balancers, bastion hosts NAT Gateway Outbound-only internet access Private subnet route table App servers needing patches, external APIs Service Gateway Access OCI services without internet Private subnet route table Object Storage, Autonomous DB, OCI APIs DRG (Dynamic Routing Gateway) On-premises / cross-region connectivity VCN attachment VPN, FastConnect, inter-region peering LPG (Local Peering Gateway) VCN-to-VCN within same region VCN attachment Shared services VCN, hub-spoke topology
Step 3: Create the VCN and Subnets (Python SDK) import oci
config = oci.config.from_file("~/.oci/config" )
network = oci.core.VirtualNetworkClient(config)
vcn = network.create_vcn(
oci.core.models.CreateVcnDetails(
compartment_id="COMPARTMENT_OCID" ,
display_name="prod-vcn" ,
cidr_blocks=["10.0.0.0/16" ],
dns_label="prodvcn" ,
)
).data
print (f"VCN created: {vcn.id } " )
web_subnet = network.create_subnet(
oci.core.models.CreateSubnetDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="web-subnet-public" ,
cidr_block="10.0.1.0/24" ,
dns_label="web" ,
prohibit_internet_ingress=False ,
)
).data
app_subnet = network.create_subnet(
oci.core.models.CreateSubnetDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="app-subnet-private" ,
cidr_block="10.0.2.0/24" ,
dns_label="app" ,
prohibit_internet_ingress=True ,
)
).data
db_subnet = network.create_subnet(
oci.core.models.CreateSubnetDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="db-subnet-private" ,
cidr_block="10.0.3.0/24" ,
dns_label="db" ,
prohibit_internet_ingress=True ,
)
).data
print (f"Subnets: web={web_subnet.id } , app={app_subnet.id } , db={db_subnet.id } " )
Step 4: Create Gateways and Route Tables
igw = network.create_internet_gateway(
oci.core.models.CreateInternetGatewayDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="prod-igw" ,
is_enabled=True ,
)
).data
nat = network.create_nat_gateway(
oci.core.models.CreateNatGatewayDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="prod-nat" ,
)
).data
services = network.list_services().data
all_services = next (s for s in services if "All" in s.name)
sgw = network.create_service_gateway(
oci.core.models.CreateServiceGatewayDetails(
compartment_id="COMPARTMENT_OCID" ,
vcn_id=vcn.id ,
display_name="prod-sgw" ,
services=[oci.core.models.ServiceIdRequestDetails(service_id=all_services.id )],
)
).data
print (f"Gateways: igw={igw.id } , nat={nat.id } , sgw={sgw.id } " )
Step 5: Terraform Deployment # provider.tf
terraform {
required_providers {
oci = {
source = "oracle/oci"
version = ">= 5.0"
}
}
}
provider "oci" {
config_file_profile = "DEFAULT"
}
# vcn.tf
resource "oci_core_vcn" "prod" {
compartment_id = var.compartment_id
display_name = "prod-vcn"
cidr_blocks = ["10.0.0.0/16"]
dns_label = "prodvcn"
}
resource "oci_core_internet_gateway" "prod" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "prod-igw"
enabled = true
}
resource "oci_core_nat_gateway" "prod" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "prod-nat"
}
resource "oci_core_subnet" "web" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "web-subnet-public"
cidr_block = "10.0.1.0/24"
dns_label = "web"
prohibit_internet_ingress = false
route_table_id = oci_core_route_table.public.id
security_list_ids = [oci_core_security_list.web.id]
}
resource "oci_core_subnet" "app" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "app-subnet-private"
cidr_block = "10.0.2.0/24"
dns_label = "app"
prohibit_internet_ingress = true
route_table_id = oci_core_route_table.private.id
security_list_ids = [oci_core_security_list.app.id]
}
resource "oci_core_route_table" "public" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "public-rt"
route_rules {
destination = "0.0.0.0/0"
network_entity_id = oci_core_internet_gateway.prod.id
}
}
resource "oci_core_route_table" "private" {
compartment_id = var.compartment_id
vcn_id = oci_core_vcn.prod.id
display_name = "private-rt"
route_rules {
destination = "0.0.0.0/0"
network_entity_id = oci_core_nat_gateway.prod.id
}
}
Step 6: Component Mapping (AWS/Azure → OCI) Concept AWS Azure OCI Virtual network VPC VNet VCN Subnet Subnet (AZ-scoped) Subnet Subnet (regional) Internet access Internet Gateway — (default) Internet Gateway Outbound only NAT Gateway NAT Gateway NAT Gateway Private service access VPC Endpoint Private Endpoint Service Gateway Cross-network peering VPC Peering VNet Peering LPG / DRG Firewall rules Security Group NSG NSG + Security List Load balancer ALB/NLB Azure LB OCI Load Balancer Managed database RDS/Aurora Azure SQL Autonomous Database
Output Successful completion produces:
A 3-tier VCN architecture with public (web), private (app), and private (db) subnets
Internet Gateway, NAT Gateway, and Service Gateway correctly routed to their respective subnets
Route tables with proper rules (public → IGW, private → NAT/SGW)
Terraform code deployable with terraform plan && terraform apply
Component mapping table for teams coming from AWS or Azure
Error Handling Error Code Cause Solution NotAuthorizedOrNotFound 404 Missing IAM policy for VCN creation Add allow group netadmins to manage virtual-network-family in compartment prod InvalidParameter 400 Overlapping CIDR blocks Ensure VCN CIDR does not overlap with existing VCNs or on-premises networks LimitExceeded 400 Hit VCN or subnet service limit Request limit increase via Console > Governance > Service Limits TooManyRequests 429 Rate limited during bulk creation Add 2-second delays between resource creation calls InternalError 500 OCI service issue during provisioning Retry after 60 seconds; check https://ocistatus.oraclecloud.com Terraform provider crash — OCI provider version incompatibility Pin provider: version = "~> 5.0" (see oraclecloud-upgrade-migration)
Examples Quick VCN validation (CLI):
oci network vcn list \
--compartment-id "$COMPARTMENT_OCID " \
--query 'data[].{name:"display-name", cidr:"cidr-blocks", state:"lifecycle-state"}' \
--output table
oci network subnet list \
--compartment-id "$COMPARTMENT_OCID " \
--vcn-id "$VCN_OCID " \
--query 'data[].{name:"display-name", cidr:"cidr-block", public:"prohibit-internet-ingress"}' \
--output table
Validate route table connectivity:
oci network route-table get --rt-id "$PUBLIC_RT_OCID " \
--query 'data."route-rules"[].{dest:destination, target:"network-entity-id"}' \
--output table
Resources
Next Steps After deploying the architecture, run oraclecloud-prod-checklist to validate production readiness, or see oraclecloud-migration-deep-dive for translating existing AWS/Azure workloads into this architecture pattern.
