Description

Ensure production private services belong to a project environment that has Block cross-environment connections turned on. Private services have no public URL, but by default they can be reached by every service in the same workspace and region over the private network.

Rationale

A private service is only protected from the internet, not from other services. Without isolation, a staging or test service, or a compromised service in another environment, can connect to the production private service directly. Placing it in an isolated environment limits access to services in the same environment.

Impact

  • Only services in the production environment can reach the private service

  • Limits lateral movement from other environments

  • Services outside the environment that relied on it must be moved or reconfigured

Default Value

By default, private services can be reached over the private network by all services in the same workspace and region. Network-isolated environments require a Pro workspace or higher.

Pre-Requisites

  • Workspace Admin role

  • Pro plan or higher

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the private service to open it.

  3. Check which project environment the service belongs to.

  4. Open that environment's ••• menu and check that Block cross-environment connections is turned on.

  5. If the service is not in an environment, or the environment is not isolated, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open the private service's ••• menu and click Move, then select the production project environment.

  3. From your workspace home, open the project and scroll to the production environment.

  4. Click the ••• menu at the top right of the environment and toggle on Block cross-environment connections.

  5. Restart services in the environment to close existing cross-environment connections.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home, open the project and scroll to the production environment.

  3. Toggle off Block cross-environment connections, or move the service back out of the environment.

Reference