Egress traffic policy enforcement at target service on traffic from service tenancy
Techniques for enforcing an egress policy at a target service are described. In an example, traffic is generated for a customer tenancy, where the traffic is generated by a multi-tenancy service. The traffic can be destined to the target service. The traffic can be tagged by the multi-tenancy service with information indicating that the traffic is egressing therefrom on behalf of the customer tenancy. The customer tenancy can be associated with the egress policy. The target service can determine the egress policy based on the information tagged to the traffic and can enforce the egress policy on the traffic that the target service is receiving.
1. A computer-implemented method comprising:
receiving, by a gateway having a network location that belongs to a multi-customer tenancy hosting services for multiple customer tenancies hosted by a cloud infrastructure, traffic of a first service hosted by the multi-customer tenancy for a customer, wherein the traffic is destined to a second service of a service tenancy of the cloud infrastructure, and wherein the customer is associated with a customer tenancy hosted by the cloud infrastructure;
tagging, by the gateway, the traffic with a first identifier of the gateway,
wherein the first identifier is different from a network address of the gateway and includes a data plane identifier (DPID),
the first identifier is translated into a second identifier, wherein the second identifier is a cloud identifier (CID),
the first identifier and the second identifier are associated with an egress policy of the customer, and
the egress policy indicates whether the traffic is to be allowed or disallowed based on the network location of the gateway; and
sending, by the gateway, the traffic after being tagged to the second service of the service tenancy.
2. The computer-implemented method of claim 1 , wherein the network location includes either a first network location of a network associated with the customer or a second network location of the multi-customer tenancy.
3. The computer-implemented method of claim 1 , wherein the second identifier is used to determine the egress policy associated with the customer tenancy.
4. The computer-implemented method of claim 3 , wherein the second identifier is generated based on a registration of the network location by the customer in association with defining the egress policy.
5. The computer-implemented method of claim 1 , wherein tagging the traffic comprises including, in the traffic, the first identifier, a third identifier of the customer tenancy, and a source internet protocol (IP) address.
6. The computer-implemented method of claim 5 , wherein the first identifier, the third identifier, and the source IP address are included in one or more IP options fields of a packet that corresponds to the traffic.
7. The computer-implemented method of claim 5 , further comprising:
receiving, by the second service of the service tenancy, the traffic;
determining, by the second service of the service tenancy, an action to be performed on the traffic based on a lookup of the egress policy, wherein the action includes either allowing or disallowing the traffic, and wherein the lookup is based on the third identifier; and
performing, by the second service of the service tenancy, the action on the traffic.
8. A system having a network location that belongs to a multi-customer tenancy hosting services for multiple customer tenancies hosted by a cloud infrastructure, the system comprising:
one or more processors; and
one or more memory storing instructions that, upon execution by the one or more processors, configure the system to:
receive traffic of a first service hosted by the multi-customer tenancy for a customer, wherein the traffic is destined to a second service of a service tenancy of the cloud infrastructure, and wherein the customer is associated with a customer tenancy hosted by the cloud infrastructure;
tag the traffic with a first identifier of a gateway,
wherein the first identifier is different from a network address of the gateway and includes a data plane identifier (DPID),
the first identifier is translated into a second identifier, wherein the second identifier is a cloud identifier (CID),
the first identifier and the second identifier are associated with an egress policy of the customer, and
the egress policy indicates whether the traffic is to be allowed or disallowed based on the network location of the gateway; and
send the traffic after being tagged to the second service of the service tenancy.
9. The system of claim 8 , wherein the network location includes either a first network location of a network associated with the customer or a second network location of the multi-customer tenancy.
10. The system of claim 8 , wherein the second identifier is used to determine the egress policy associated with the customer tenancy.
11. The system of claim 10 , wherein the second identifier is generated based on a registration of the network location by the customer in association with defining the egress policy.
12. The system of claim 8 , wherein tagging the traffic comprises including, in the traffic, the first identifier, a third identifier of the customer tenancy, and a source internet protocol (IP) address.
13. The system of claim 12 , wherein the first identifier, the third identifier, and the source IP address are included in one or more IP options fields of a packet that corresponds to the traffic.
14. The system of claim 12 , wherein the one or more memory store further instructions that, upon execution by the one or more processors, further configure the system to:
receive, by the second service of the service tenancy, the traffic;
determine, by the second service of the service tenancy, an action to be performed on the traffic based on a lookup of the egress policy, wherein the action includes either allowing or disallowing the traffic, and wherein the lookup is based on the third identifier; and
perform, by the second service of the service tenancy, the action on the traffic.
15. One or more non-transitory computer-readable storage media storing instructions that, upon execution on a system, cause the system to perform operations comprising:
receiving traffic of a first service hosted by a multi-customer tenancy for a customer, wherein the traffic is destined to a second service of a service tenancy of a cloud infrastructure, and wherein the customer is associated with a customer tenancy hosted by the cloud infrastructure, the system having a network location that belongs to the multi-customer tenancy hosting services for multiple customer tenancies hosted by the cloud infrastructure;
tagging the traffic with a first identifier of a gateway,
wherein the first identifier is different from a network address of the gateway and includes a data plane identifier (DPID),
the first identifier is translated into a second identifier, wherein the second identifier is a cloud identifier (CID),
the first identifier and the second identifier are associated with an egress policy of the customer, and
the egress policy indicates whether the traffic is to be allowed or disallowed based on the network location of the gateway; and
sending the traffic after being tagged to the second service of the service tenancy.
16. The one or more non-transitory computer-readable storage media of claim 15 , wherein the network location includes either a first network location of a network
associated with the customer or a second network location of the multi-customer tenancy.
17. The one or more non-transitory computer-readable storage media of claim 15 , wherein the second identifier is used to determine the egress
policy associated with the customer tenancy.
18. The one or more non-transitory computer-readable storage media of claim 17 , wherein the second identifier is generated based on a registration of the network location by the customer in association with defining the egress policy.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein tagging the traffic comprises including, in the traffic, the first identifier,
a third identifier of the customer tenancy, and a source internet protocol (IP) address.
20. The one or more non-transitory computer-readable storage media of claim 19 , wherein the first identifier, the third identifier, and the source IP address are included in one or more IP options fields of a packet that corresponds to the traffic.