Description

Ensure each Render Key Value instance has internal authentication enabled, so that connections over the private network must provide a username and password. Without it, any service in the same workspace and region can read or change the stored data.

Rationale

By default, Key Value instances accept unauthenticated internal connections. Any compromised or misconfigured service on the same private network could then read cached sessions, tokens, or queued jobs, or change them. Requiring authentication means only services with the password can connect.

Impact

  • Only services with the password can connect internally

  • Protects cached sessions, tokens, and queues

  • Existing unauthenticated connections break unless migrated first

Default Value

By default, internal connections are unauthenticated. External connections always require authentication.

Pre-Requisites

  • Admin or Developer role (Admin for protected environments)

  • All connecting services updated to use an authenticated URL

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Key Value instance to open it.

  3. On the Info page, scroll down to the Connections section and check whether internal authentication is enabled (the internal URL includes a username and password).

  4. If it is not enabled, follow the implementation steps.

Implementation Steps

  1. Update every connecting service to use an authenticated internal URL first, for example redis://default:<password>@<internal-host>:6379, using the password from the external URL in the Connect menu.

  2. Sign in to the Render Dashboard at https://dashboard.render.com.

  3. From your workspace home (or project), click the Key Value instance to open it.

  4. On the Info page, scroll down to the Connections section and click Enable Internal Authentication.

  5. Review the dialog and click Enable Internal Authentication. The instance restarts and is unavailable for a few seconds.

Backout Plan

  1. Render's documentation does not describe a way to turn internal authentication off. Keep all services on the authenticated URL, and contact Render support if you need to revert.

Reference