search

aws / apprunner-roadmap

This is the public roadmap for AWS App Runner.
https://aws.amazon.com/apprunner/
Other
301 stars 14 forks source link

Restrict access to App runner service using security group is not working. #113

Closed Dhyanesh97 closed 1 year ago

Dhyanesh97 commented 2 years ago

I have created an app runner service and attached security group using VPC connector.

Here security group is used only to allow app runner to communicate to services within VPC ? Or it can be used to restrict access to App runner as well ?

My Requirement is to basically setup inbound rules for app runner and don't want it to be publicly accessed.

LeonardoAgri commented 1 year ago

Still the same issue here, I want to access from public internet but use a SG to restrict the incoming traffic. I will keep an eye on the road map.

rhbecker commented 1 year ago

Is this need not satisfied via WAF web ACLs?

I realize this issue is about using Security Groups, but the original poster's requirement is stated as ...

My Requirement is to basically setup inbound rules for app runner and don't want it to be publicly accessed.

I don't have direct experience using WAF web ACLs - my assumption that it can be used to solve this need is based entirely on my understanding of the App Runner documentation of this feature and the blog post announcing its availability.

I'm asking because I want to validate my own understanding, as I too have this need.

jvisker commented 1 year ago

@snnles I'm just wondering "Coming Soon" is still accurate considering it was marked that way in September.

smeera381 commented 1 year ago

App Runner supports private endpoints accessible only from within VPC. You can learn more about the feature in the below What's New post and blogposts mentioned in the announcement.

https://aws.amazon.com/about-aws/whats-new/2022/11/aws-app-runner-supports-privately-accessible-services-amazon-vpc/

Rileyjrjohns commented 1 year ago

Hello, i'm also quite surprised that app runner is not flexible about networking. For example, i allow some Ip's adress only to access a mongoDB Replica with security group settings. I can't find any option/solution to allow my apprunner to access it without set my sg to allow all ips... It's crucial to have this kind of possibilities.

as14692 commented 1 year ago

@jsheld Is it possible to access the AppRunner service from the public internet and use a SG to restrict the incoming traffic? Looks like it supports only private endpoints accessible "only from within the VPC and not from public internet". Please verify.

Dhyanesh97 commented 1 year ago

@jsheld We want it to be accessed from public internet but with restricted incoming traffic using security group.

Rileyjrjohns commented 1 year ago

@as14692 i searched for it, you can't have a static ip or something like that. Or it's maybe possible to do more complex stuff to open it and expose via a static ip inside the vpc. But for a service claiming easy setup, we are quite far 😅

as14692 commented 1 year ago

@jsheld We want it to be accessed from public internet but with restricted incoming traffic using security group.

@Dhyanesh97 Please reopen the issue if you can.

jsheld commented 1 year ago

The recommendation is to use a VPC endpoint and associate the security group with that endpoint accordingly. I believe @smeera381 provided a link to that documentation above.

tom-carbontrail commented 9 months ago

The recommendation is to use a VPC endpoint and associate the security group with that endpoint accordingly. I believe @smeera381 provided a link to that documentation above.

This still doesn't allow you to add a security group to the ingress of the app runner.

I would also like to see this functionality. My current workaround (at extra cost) is to use a WAF, and limit the IP addresses which can traverse the WAF ACL to those that I want.