How to Transfer Files Between an OCI VM (Compute Instance) and Object Storage (Part - 3) 

Check out Part -1 - Install OCI CLI, pre-requisite 

Check out Part -2 - Upload files to Object storage

In this article, let’s take the reverse approach:

downloading a file from an OCI Object Storage bucket into a VM that lives in a private subnet.

This is a common scenario — your production VMs are usually in private subnets with no public IP, and you still need to move files in and out efficiently.

Let me explain the simplest way to do it.

🔹 Key Challenge

A private-subnet VM cannot reach the internet directly.

But the good news,

👉 OCI CLI works perfectly inside private subnets via the Service Gateway, as long as it's properly configured.

If your subnet is connected to:

✔️ Service Gateway

AND

✔️ Object Storage Public Endpoint allowed

…you can directly download objects from Object Storage using CLI.

If your subnet isn't configured this way, you can still use the OCI Bastion Service to connect securely and run CLI commands.

Step 1: Confirm Network Access to Object Storage

From the private VM, run:

#> oci os ns get

If you get a valid namespace response, you're connected to Object Storage.

If it fails, ensure:

-> Subnet has Service Gateway attached

-> Route table has: 0.0.0.0/0 → Service Gateway

-> No overly restrictive security lists

Step 2: Download a File from Object Storage

Use the oci os object get command.

Basic Download Command

oci os object get \

  --bucket-name <bucket_name> \

  --name <object_name> \

  --file <output_file_name>

Example

Download db_backup.tar.gz from bucket my-backup-bucket:

oci os object get \

  --bucket-name my-backup-bucket \

  --name db_backup.tar.gz \

  --file db_backup.tar.gz

This saves the file in your current working directory.

Download Large Files

If you're dealing with multi-GB backups:

oci os object get \

  --bucket-name my-backup-bucket \

  --name largefile.gz \

  --file largefile.gz \

  --multipart-download-threshold 64 \

  --part-size 64

Step 3: Verify the File

After download:

ls -lh

and optionally check checksum:

md5sum db_backup.tar.gz

If SSH is disabled or restricted, Access Private VM via OCI Bastion

Click here to know more how to access Private VM via OCI Bastion service

Once you're inside the bastion session, the exact same download commands work.

🎉 That's It!

Thanks & Regards,

Chandan Tanwani