Description

Ensure each production environment has Block cross-environment connections turned on, so that private network traffic cannot cross the environment's boundary. Services inside the production environment can still talk to each other, but staging and test services cannot reach production services or databases over the private network.

Rationale

By default, all Render services in the same workspace and region share one private network. A bug or compromise in a staging service could then reach production databases directly. Blocking cross-environment traffic isolates production and prevents non-production systems from connecting to it.

Impact

  • Staging and test services cannot reach production over the private network

  • Limits the damage from a compromised non-production service

  • Existing connections continue until services are restarted

Default Value

By default, environments do not block cross-environment traffic. Network-isolated environments require a Pro workspace or higher.

Pre-Requisites

  • Workspace Admin role

  • Pro plan or higher

  • Confirmation that no required traffic flows between environments

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home, open the project and scroll to the production environment.

  3. Click the ••• menu at the top right of the environment and check whether Block cross-environment connections is turned on.

  4. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home, open the project and scroll to the production environment.

  3. Click the ••• menu at the top right of the environment, then toggle on Block cross-environment connections.

  4. Restart the services in the environment to close any existing cross-environment connections.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home, open the project and scroll to the production environment.

  3. Click the ••• menu at the top right of the environment and toggle off Block cross-environment connections.

Reference