# Ensure Key Value instances require authentication for internal connections

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876669175583-ensure-key-value-instances-require-authentication-for-internal-connections
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Render Key Value instance has internal authentication enabled, so that connections over the private network must provide a username and password. Without it, any service in the same workspace and region can read or change the stored data.

**Rationale**

By default, Key Value instances accept unauthenticated internal connections. Any compromised or misconfigured service on the same private network could then read cached sessions, tokens, or queued jobs, or change them. Requiring authentication means only services with the password can connect.

**Impact**

-   Only services with the password can connect internally
    
-   Protects cached sessions, tokens, and queues
    
-   Existing unauthenticated connections break unless migrated first
    

**Default Value**

By default, internal connections are unauthenticated. External connections always require authentication.

**Pre-Requisites**

-   Admin or Developer role (Admin for protected environments)
    
-   All connecting services updated to use an authenticated URL
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Key Value instance to open it.
    
3.  On the Info page, scroll down to the Connections section and check whether internal authentication is enabled (the internal URL includes a username and password).
    
4.  If it is not enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Update every connecting service to use an authenticated internal URL first, for example redis://default:<password>@<internal-host>:6379, using the password from the external URL in the Connect menu.
    
2.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
3.  From your workspace home (or project), click the Key Value instance to open it.
    
4.  On the Info page, scroll down to the Connections section and click Enable Internal Authentication.
    
5.  Review the dialog and click Enable Internal Authentication. The instance restarts and is unavailable for a few seconds.
    

**Backout Plan**

1.  Render's documentation does not describe a way to turn internal authentication off. Keep all services on the authenticated URL, and contact Render support if you need to revert.
    

**Reference**

-   [https://render.com/docs/key-value](https://render.com/docs/key-value)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.