Version 2.9.115
Database, Cache and Queue Firewalls Now Apply Inside Your Team
The inbound rules on a managed database, cache or queue now decide, port by port, which of your own resources can connect over the private network, not just who reaches the public endpoint.
- A port with an allow rule that has no sources, or one from 0.0.0.0/0 or ::/0, stays open to your whole team
- A port whose allow rules all list sources accepts only what they pick: Rapids containers and their runs, VPS instances, private networks, managed apps, and other databases, caches or queues
Show 5 more changes
- A port that no allow rule covers is now closed to your own resources too, as on the public endpoint, so add an allow rule for everything your team uses, such as a queue's management port
- IP addresses never match your team's resources, so a rule that lists only addresses keeps the port closed inside your team; pick your apps under Sources as well
- Rules with sources never cut off the instance's own replicas, connection proxies, metrics, backups or SQL Studio
- Teams you have peered with reach only the ports open to your whole team
- Managed apps can now be picked as sources, a deleted source stays on the rule marked deleted until you remove it, and rules created through the API keep their port and picked sources