Agent Wranglers

INF-87Recommended

Reach managed services over private endpoints

Connect servers to managed databases, storage and secret stores over private endpoints inside your network. Turn off the public address of each managed data service.

By Agent Wranglers. Updated .

How to do it

Many managed services answer on a public address by default, guarded only by a password or a key. A private endpoint gives the service an address inside your network, such as AWS PrivateLink, Azure Private Link or Google Private Service Connect. Then turn off public access on the service itself, and limit the storage or key policy to calls that come through the endpoint. Servers then need no route to the internet to reach their data, which also helps Limit where servers can send traffic. Databases themselves sit in private subnets, as Keep databases in private subnets says.

Examples

Terraform example

resource "aws_vpc_endpoint" "s3" {
  vpc_id          = aws_vpc.main.id
  service_name    = "com.amazonaws.eu-north-1.s3"
  route_table_ids = [aws_route_table.private.id]
}

resource "azurerm_postgresql_flexible_server" "orders" {
  name                          = "orders"
  public_network_access_enabled = false
  # other settings left out
}

How to check

A script lists every managed database, bucket and secret store in production. Each has public network access turned off, and a connection from outside the network fails. The app still reaches each one through its endpoint.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-endpoints">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.