Oracle Cloud Storage

Oracle Cloud Storage public and private buckets can be used as origins with Fastly.

Before you begin

Before you begin the setup and configuration steps required to use Oracle Cloud as an origin, keep in mind the following:

  • You must have a valid Oracle Cloud account. Before you can create a new bucket and upload files to it for Fastly to use, you must first create an Oracle Cloud account at the Oracle website.
  • Oracle Cloud implements both its own proprietary API and an S3 Compatible API. Currently, Fastly supports private buckets only via the S3 Compatible API.

Using Oracle Cloud Storage as an origin

To use Oracle Cloud Storage as an origin, follow the steps below.

Creating a new bucket

Data in Oracle Cloud Storage is stored in buckets. Follow these steps to create a new bucket via the Oracle Cloud web interface.

TIP

The Oracle Guide provides more details on how to create a bucket.

  1. Log in to your Oracle account.

  2. Open the navigation menu in the upper left and navigate to Object Storage, then select Object Storage.

    Oracle Cloud Object Storage New Bucket window

  3. Select a compartment from the Compartment list on the left side of the page.

  4. Click Create a Bucket.

  5. In the Bucket Name field, enter a unique bucket name. Bucket names must be unique within the namespace and cannot be nested. The name can contain letters, numbers, dashes, and periods.

    Oracle Cloud Object Storage New Bucket window

  6. Click Create a Bucket. The new bucket appears in the list of buckets on the Oracle Cloud Storage Buckets page.

  7. By default, new buckets are private. Click on three dots on the right side of the bucket and select Edit Visibility. Change the visibility to Public and deselect the Allow users to list objects from this bucket option.

  8. Upload a file to the new bucket you just created.

Finding your bucket's namespace and hostname

To set up a Fastly service that interacts with your Oracle Cloud Storage, you will need to know the namespace identifier and hostname assigned to the bucket you created and uploaded files to.

To find your namespace, click on the bucket and examine the Bucket Information tab. In this example the namespace is decafbaddeadbeef.

Oracle Cloud Storage Bucket Details

To determine your bucket's hostname:

  • If you're using the native Oracle API then the hostname takes the form of objectstorage.<region>.oraclecloud.com (e.g objectstorage.us-ashburn-1.oraclecloud.com).
  • If you're using the S3 Compatible API then the hostname takes the form of <namespace id>.compat.objectstorage.<region>.oraclecloud.com (e.g decafbaddeadbeef.compat.objectstorage.us-ashburn-1.oraclecloud.com).

Creating a new service

To create a new Fastly service, you must first create a new domain and then create a new host and edit it to accept traffic for Oracle Cloud Storage. Instructions to do this appear in our guide to creating a new service. While completing these instructions, keep the following in mind:

  • When you create the new host, enter the Oracle bucket's hostname in the Hosts field on the Origins page. See Finding your bucket's namespace and hostname.
  • When you edit the host details on the Edit this host page, confirm the Transport Layer Security (TLS) area information for your host. Specifically, make sure you do the following:
    • Secure the connection between Fastly and your origin.
    • Enter your bucket's hostname in the Certificate hostname field.
    • Select the checkbox to match the SNI hostname to the Certificate hostname (it appears under the SNI hostname field).
    • (Optional) Enable shielding by choosing the appropriate shielding location from the Shielding menu. When using Oracle Cloud Storage, this means you must choose a shielding location closest to the most appropriate Oracle region.
  • Decide whether or not you should specify an override host in the Advanced options area which is the same as your bucket hostname.

Using the Oracle Cloud API with public objects

To use the Oracle Cloud API with public objects, you need to either create a new header, or a VCL Snippet. The purpose of the header or VCL snippet is to rewrite request URLs for your Oracle Cloud Storage instance.

Using a Header object

  1. On your Fastly service's configuration page, click Create header to create a new header.
  2. Fill out the Create a header fields as follows:
    • In the Name field, enter Rewrite Oracle Cloud Storage URL.
    • From the Type menu, select Request, and from the Action menu, select Set.
    • In the Destination field, enter url.
    • From the Ignore if set menu, select No.
    • In the Priority field, enter 20.
  3. In the Source field, enter "/n/<namespace id>/b/<bucket name>/o" req.url (e.g., "/n/decafbaddeadbeef/b/fastly-bucket/o" req.url).
  4. Click Create.
  5. Click Add a condition next to the Rewrite Oracle Cloud Storage URL header.
  6. Click Create a new request condition.
  7. Fill out the condition fields as follows:
    • In the Name field, enter Oracle Cloud Storage Shielding.
    • In the Apply if field, enter (req.method == "GET" && !req.backend.is_shield) {}.
  8. Click Save and apply.
  9. Click Activate to deploy your configuration changes.

Using a VCL Snippet

  1. Click VCL Snippets on your service's configuration page, then click Create Snippet.

  2. In the Create a VCL Snippet page, enter a name for the snippet.

  3. Select within subroutine to specify its placement, and miss as the subroutine type.

    Select VCL Snippet type

  4. Add the following code to the VCL field. Change the values of the oracleNamespace and oracleBucket variables to match your Oracle namespace and bucket.

    1declare local var.oracleNamespace STRING;
    2declare local var.oracleBucket STRING;
    3set var.oracleNamespace = "YOUR_ORACLE_NAMESPACE_ID"; # Change this value to your own data
    4set var.oracleBucket = "YOUR_ORACLE_BUCKET_NAME"; # Change this value to your own data
    5
    6if (req.method == "GET" && !req.backend.is_shield) {
    7 set bereq.url = "/n/" var.oracleNamespace "/b/" var.oracleBucket "/o/" bereq.url;
    8}

Using the S3 Compatible API with public objects

To use the S3 Compatible API with public objects you must create a new header, as explained below.

  1. On your Fastly service's configuration page, click Create header to create a new header.
  2. Fill out the Create a header fields as follows:
    • In the Name field, enter Rewrite Oracle Cloud Storage URL.
    • From the Type menu, select Request, and from the Action menu, select Set.
    • In the Destination field, enter url.
    • From the Ignore if set menu, select No.
    • In the Priority field, enter 20.
  3. In the Source field, enter "/<bucket name>/" req.url (e.g., "/fastly-bucket/o" req.url).
  4. Click Create.
  5. Click Activate to deploy your configuration changes.

Private Buckets

IMPORTANT

Currently, Fastly can only support private objects using the S3 Compatible API.

To use an Oracle Cloud Storage private bucket with Fastly you must implement version 4 of Amazon’s header-based authentication. You can do this using custom VCL. Keep in mind the following:

  • You will need an Oracle Customer Secret Key which consists of an Access Key and Secret Key.
  • You must use path-based access. Virtual host-style access (for example, accessing a bucket as <bucketname>.<namespace>.compat.objectstorage.<region>.oraclecloud.com) is not supported.

The following table lists the information you need to obtain from Oracle Cloud Storage before starting.

ItemDescription
NamespaceThe namespace identifier assigned to your bucket (see Finding your bucket's namespace and hostname.
Bucket nameThe name of your OCS bucket. When you download items from your bucket, this is the string listed in the URL path or hostname of each object.
RegionThe OCS region code of the location where your bucket resides (e.g., us-east-1).
Access keyThe OCS access key string for your account that has at least read permission on the bucket.
Secret keyThe OCS secret access key paired with the access key above.

Once you have this information, you can configure your Fastly service to authenticate against your S3 bucket using header authentication by calculating the appropriate header value in VCL.

IMPORTANT

Consider leaving the Override host field for the origin blank in your service settings. This setting will override the host header from the snippets shown here and may invalidate the signature that authenticates the information being sent.

Start by creating a regular VCL snippet. Give it a meaningful name, such as AWS protected origin. When you create the snippet, select within subroutine to specify its placement and choose miss as the subroutine type. Then, populate the VCL field with the following code (be sure to change specific values as noted to ones relevant to your own AWS bucket):

  1. Click VCL Snippets on your service's configuration page, then click Create Snippet.

  2. In the Create a VCL Snippet page give the snippet a meaningful name, such as AWS protected origin.

  3. Select within subroutine to specify snippet placement, and miss as the subroutine type.

    Select VCL Snippet type

  4. Add the following code to the VCL field. Be sure to change the values of the variables (ocsNamespace, ocsAccessKey, etc.) to match your Oracle environment.

    1declare local var.ocsNamespace STRING;
    2declare local var.ocsAccessKey STRING;
    3declare local var.ocsSecretKey STRING;
    4declare local var.ocsS3Bucket STRING;
    5declare local var.ocsRegion STRING;
    6declare local var.canonicalHeaders STRING;
    7declare local var.signedHeaders STRING;
    8declare local var.canonicalRequest STRING;
    9declare local var.canonicalQuery STRING;
    10declare local var.stringToSign STRING;
    11declare local var.dateStamp STRING;
    12declare local var.signature STRING;
    13declare local var.scope STRING;
    14
    15set var.ocsNamespace = "YOUR_OCS_NAMESPACE"; # Change this value to your own data
    16set var.ocsAccessKey = "YOUR_OCS_ACCESS_KEY"; # Change this value to your own data
    17set var.ocsSecretKey = "YOUR_OCS_SECRET_KEY"; # Change this value to your own data
    18set var.ocsS3Bucket = "YOUR_OCS_BUCKET_NAME"; # Change this value to your own data
    19set var.ocsRegion = "YOUR_OCS_REGION"; # Change this value to your own data
    20
    21if (req.method == "GET" && !req.backend.is_shield) {
    22
    23 set bereq.http.x-amz-content-sha256 = digest.hash_sha256("");
    24 set bereq.http.x-amz-date = strftime({"%Y%m%dT%H%M%SZ"}, now);
    25 set bereq.http.host = var.ocsNamespace ".compat.objectstorage." var.ocsRegion ".oraclecloud.com";
    26 set bereq.url = querystring.remove(bereq.url);
    27 set bereq.url = regsuball(urlencode(urldecode(bereq.url.path)), {"%2F"}, "/");
    28 set var.dateStamp = strftime({"%Y%m%d"}, now);
    29 set var.canonicalHeaders = ""
    30 "host:" bereq.http.host LF
    31 "x-amz-content-sha256:" bereq.http.x-amz-content-sha256 LF
    32 "x-amz-date:" bereq.http.x-amz-date LF
    33 ;
    34 set var.canonicalQuery = "";
    35 set var.signedHeaders = "host;x-amz-content-sha256;x-amz-date";
    36 set var.canonicalRequest = ""
    37 "GET" LF
    38 bereq.url.path LF
    39 var.canonicalQuery LF
    40 var.canonicalHeaders LF
    41 var.signedHeaders LF
    42 digest.hash_sha256("")
    43 ;
    44
    45 set var.scope = var.dateStamp "/" var.ocsRegion "/s3/aws4_request";
    46
    47 set var.stringToSign = ""
    48 "AWS4-HMAC-SHA256" LF
    49 bereq.http.x-amz-date LF
    50 var.scope LF
    51 regsub(digest.hash_sha256(var.canonicalRequest),"^0x", "")
    52 ;
    53
    54 set var.signature = digest.awsv4_hmac(
    55 var.ocsSecretKey,
    56 var.dateStamp,
    57 var.ocsRegion,
    58 "s3",
    59 var.stringToSign
    60 );
    61
    62 set bereq.http.Authorization = "AWS4-HMAC-SHA256 "
    63 "Credential=" var.ocsAccessKey "/" var.scope ", "
    64 "SignedHeaders=" var.signedHeaders ", "
    65 "Signature=" + regsub(var.signature,"^0x", "")
    66 ;
    67 unset bereq.http.Accept;
    68 unset bereq.http.Accept-Language;
    69 unset bereq.http.User-Agent;
    70 unset bereq.http.Fastly-Client-IP;
    71}

This article describes an integration with a service provided by a third party. Read our note on integrations for details.

Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.