Disable external ingress#
Security · Container App · 2023_03
Limit inbound communication for Container Apps is limited to callers within the Container Apps Environment.
Description#
Container apps allows you to expose your container app to the Internet, your VNET, or to other container apps within the same environment by enabling ingress.
When inbound access to the app is required, configure the ingress. Applications that do batch processing or consume events may not require ingress to be enabled.
When external ingress is configured, communication outside the container apps environment is enabled from your private VNET or the Internet. To restrict communication to a private VNET your Container App Environment must be deployed on a custom VNET with an Internal load balancer.
If communication outside your Container Apps Environment is not required, disable external ingress.
Recommendation#
Consider disabling external ingress.
Examples#
Configure with Azure template#
To deploy Container Apps that pass this rule:
- Set
properties.configuration.ingress.external
tofalse
.
For example:
{
"type": "Microsoft.App/containerApps",
"apiVersion": "2022-10-01",
"name": "[parameters('appName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned",
"userAssignedIdentities": {}
},
"properties": {
"environmentId": "[parameters('environmentId')]",
"template": {
"revisionSuffix": "",
"containers": "[variables('containers')]"
},
"configuration": {
"ingress": {
"external": false
}
}
}
}
Configure with Bicep#
To deploy Container Apps that pass this rule:
- Set
properties.configuration.ingress.external
tofalse
.
For example:
resource containerApp 'Microsoft.App/containerApps@2022-10-01' = {
name: appName
location: location
identity: {
type: 'SystemAssigned'
userAssignedIdentities: {}
}
properties: {
environmentId: environmentId
template: {
revisionSuffix: ''
containers: containers
}
configuration: {
ingress: {
external: false
}
}
}
}
Notes#
This rule is skipped by default because there are common cases where external ingress is required. If you don't need external ingress, enable this rule by:
- Setting the
AZURE_CONTAINERAPPS_RESTRICT_INGRESS
configuration option totrue
.
Links#
- Networking architecture in Azure Container Apps
- Set up HTTPS or TCP ingress in Azure Container Apps
- Azure deployment reference