Private endpoints and internet egress

Container endpoints on AWS can now stay inside the customer's network. The admin picks private endpoint access at initial setup:

acmectl deploy --config deployment.toml --endpoint-access private

In CloudFormation, it's the EndpointAccess parameter. Endpoints then use internal load balancers, reachable only from the VPC and the networks routed to it. With a custom domain in internal DNS, the hostname stays private too.

Containers can also get internet access without reaching anything else in the customer's network:

alien.ts

const fetcher = new alien.Container("fetcher")
  .code({ type: "image", image: "ghcr.io/acme/fetcher:1.0" })
  .security({ profile: "restricted" })
  .egress("internet")
  .build()

Outbound IPs: the deployment page lists the public addresses traffic leaves from, for services that allowlist by IP
Availability zones: the admin can pick the zones for a new AWS network on the setup page
Links: linked Containers stay reachable over private addresses

Read the docs →