Allow App Runner services to talk to AWS resources in a private Amazon VPC

[akshayram-wolverine]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request

Customers can run services on App Runner and talk to other AWS services via a public endpoint. For instances, they can talk to Amazon DynamoDB, Aurora DB with public access. But customers may also want App Runner services to access resources such as RDS instances in a private VPC.

[adilnaimi]

just waiting for this to happen, and we will migrate all our ECS workers to App runner

[boadude]

Same here, I had a lot of Fargate services, but I need to connect to RDS.

Need this before migrating to App Runner.

[raghibfaisal]

Was also wondering if there would be a way to reference the app running in App Runner somehow in another security group. For instance, if we have a database running on an EC2 server and want to allow just the app (app runner container) to access the EC2-database. The container in App-Runner does not have a security group in front of it unlike Fargate. Otherwise, we could have referenced the containers security group in the EC2-databases security group.

[greenreign]

I know it's been only a month since GA but is there any idea on timing for the next release which hopefully contains this issue? We can't wait to get off of K8s/EKS and are looking at ECS Fargate but would love to jump straight into AppRunner. But we need to connect to RDS so I'd really like to understand the potential timing on this.

[shorn]

But we need to connect to RDS ...

This is also my use-case and it's not the first time I've ruled out new AWS tech because it can't interact with RDS or other resources running in my private VPC.

It was literally the first thing I looked at when AppRunner was announced - and this issue absolutely should be in the FAQ. It seems like a general problem that AWS product releases of new tech often come out without the ability to talk to private VPC resources.

OTOH, it's totally understandable. The team is trying to release cool new tech and so they reduce the scope to a Minimal Viable Product. It's an unfortunate reality that the MVP approach often makes new AWS technologies unusable for many folks (and not just because of the private VPC resource issue either).

I wonder if it's not time for AWS to come up with a general way for customers to safely connect to private resources - some kind of "reverse VPC endpoint". Though just writing out the idea of making my RDS accessible this way is giving me the security-heebie-jeebies.

[1oglop1]

@shorn
Is it not possible?
I was in impression that I just create VPC and security group endpoint for Apprunner and RDS

rds-ep -> rds-ep-sg
apprunner-ep -> apprunner-sg

Rules:
rds-ep-sg ACCEPT TCP:5432 (postgres) from apprunner-sg
Is this not how it should work, if not please correct me I'm bit lost in Networking here

[alexpaluzzi]

@shorn
Is it not possible?
I was in impression that I just create VPC and security group endpoint for Apprunner and RDS

rds-ep -> rds-ep-sg
apprunner-ep -> apprunner-sg

Rules:
rds-ep-sg ACCEPT TCP:5432 (postgres) from apprunner-sg
Is this not how it should work, if not please correct me I'm bit lost in Networking here

How would you connect the specific App Runner service with this security group or endpoint? That's a missing piece here.

[Simbul]

I found this thread as I also tried adding a DB and was incredibly surprised to realise it wasn't possible.

A bit more research led me to AWS Copilot, which is a slightly more advanced toolkit for containerised apps. Copilot's Load Balanced Web Service option was what I needed in the end (i.e. running a containerised app with access to a DB).

Also worth noting that Copilot's Request-driven Web Service uses App Runner under the hood.

[1oglop1]

@Simbul Yeah I did not use Copilot because it's cloudformation and ECS, I can build the same thing myself using terraform/pulumi and have more control.
I was surprised that Copilot created ECS cluster even then when I created Request driven service which does not need it.

[dyaacov]

I spent 3 days trying to connect DocumentDB and ElasticCache to my new App Runner... :(

[alexpaluzzi]

I spent 3 days trying to connect DocumentDB and ElasticCache to my new App Runner... :(

How did you connect elasticache with app runner? I can't stablish connection, I'm getting timeout :(

You can't. That's what this issue is about. They're working on it.