1

I am trying to make RPC calls to my node from an AWS lambda function. Lambdas do not have a fixed set of ip address ranges. I know I can use a NAT gateway on AWS to give my lambdas a static ip, but this is expensive. In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe? Bear in mind, I do not use my node as a wallet.

2 Answers 2

1

In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe?

The Bitcoin Core RPC interface is not designed to be accessed by untrusted networks. It's not secured against DoS attacks, nor does it have any encryption, so any network operator between the client and the server can read the username/password off the wire.

You should only ever set rpcallowip to local networks.

If you need to be accessible from elsewhere, use a VPN, or a tunnel like stunnel.

0

Yes, it'd be perfectly fine.

Because, as you already know, you would restrict node access to both the desired AWS Lambda facilities and to any other AWS facilities you'd be using to query your AWS EC2 node (e.g. some other EC2 instance) by using AWS "security groups".

The rest of the universe, including the rest of the AWS-verse, won't be able to query your EC2 node, as long as you code and assign your "security groups" correctly, and as far as there is no security issue at AWS (note this includes many things, like black-hat honeypots, inside jobs by rogue-y employees, govt mandates, any sort of bad stuff).

You can use AWS for relying and exploring transactions, but remember, not your hardware, not your coin.

2
  • Could you please elaborate a bit on how I could restrict node access to my desired AWS facilities using security groups?
    – tigeryant
    Dec 4, 2022 at 12:56
  • I'd rather not, it's been half a decade since I last used Lambda to process data coming from EC2, RDS...
    – Mercedes
    Dec 4, 2022 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.