Description
Ensure applications that are meant only for internal use, such as admin panels, internal APIs, and dashboards, are deployed as private services, which have no public URL, or are protected with inbound IP rules that allow only trusted IP ranges.
Rationale
Every Render web service gets a public onrender.com URL that anyone on the internet can reach. Internal tools exposed this way are often less hardened and become easy targets for attackers. Running them as private services, or restricting access to known IPs, keeps them off the public internet.
Impact
Internal tools are not reachable from the public internet
Reduces the attack surface
Users must connect through the private network, a VPN, or an allowed IP
Default Value
Web services are publicly reachable at their onrender.com subdomain by default. Inbound IP rules for services require a Scale or Enterprise plan.
Pre-Requisites
Admin or Developer role
A list of internal-only applications
Scale or Enterprise plan for inbound IP rules
Remediation
Test Plan
Sign in to the Render Dashboard at https://dashboard.render.com.
Review the web services in your workspace and identify any that are internal-only.
For each one, open the service's Settings page and check whether inbound IP rules restrict access to trusted ranges.
If an internal app is a public web service with no IP restriction, follow the implementation steps.
Implementation Steps
Option 1: Create the application as a private service (New > Private Service) with the same repository and settings, move traffic to it over the private network, then delete the public web service.
Option 2 (Scale or Enterprise): open the web service's Settings page, add inbound IP rules that allow only your trusted IP ranges, and save.
Confirm the application is no longer reachable from untrusted networks.
Backout Plan
Delete the inbound IP rules from the service's Settings page, or restore the public web service if it was replaced.
Reference