Architecture for selective use of private paths between cloud services
Systems and methods are provided for allowing function-initiated traffic of an on-demand code execution system within a cloud provider network to be routed to a private path such based on opt-in settings. An opt-in request may be received indicating a desire of a function invoker to use a private path. Subsequent to the opt-in request, a function invocation request may be received to send communication to a service within the cloud provider network and external to the on-demand code execution system. Subsequent to the function invocation request, a virtual execution environment may be configured to execute the function with mapping of a network-based service to an IP address of a private endpoint. The function is then executed with its traffic sent to the private endpoint.
1. A system comprising:
a cloud provider network in communication with a public internet;
an on-demand code execution service comprising a first set of one or more computing devices within a virtual private cloud of the cloud provider network, wherein the on-demand code execution service is configured to provide on-demand execution of function code;
a plurality of network-based services comprising a second set of one or more computing devices configured to provide computing services via both the cloud provider network and the public internet; and
an endpoint manager configured to provide an opt-in option for a private path to the plurality of network-based services via private internet protocol (IP) addresses not accessible via the public internet, wherein the endpoint manager comprises a third set of one or more computing devices configured to:
receive, from a function invoker, a first request to opt-in to the private path for communications from functions invoked by the function invoker on the on-demand code execution service;
receive, from the function invoker, a second request to invoke a function;
determine, based on the first request to opt-in to the private path, that all communications initiated by the invoked function to a network-based service of the plurality of network-based services are to remain within the cloud provider network until the communications reach the network-based service via the private IP addresses; and
configure the on-demand code execution service to:
execute code associated with the invoked function within a virtual execution environment of the on-demand code execution service; and
route a communication, initiated by the invoked function executing in the virtual execution environment and destined for the network-based service, to a virtual private cloud endpoint associated with the on-demand code execution service, wherein the virtual private cloud endpoint is configured to route the communication to the network-based service only via the private IP addresses such that the communication does not travel over the public internet.
2. The system of claim 1 , wherein the endpoint manager is further configured to:
intercept a domain name system (DNS) request initiated by the invoked function for an IP address to which the communication destined for the network-based service is to be sent; and
reply to the DNS request with an IP address of the virtual private cloud endpoint associated with one of the private IP addresses.
3. The system of claim 2 , wherein the endpoint manager is further configured to:
intercept a second DNS request, initiated by a second function invoked by a second function invoker, for a second IP address to which a second communication destined for the network-based service is to be sent; and
reply to the second DNS request with an IP address of an internet gateway to a public IP address based on the second function invoker opting-out of the private path.
4. The system of claim 1 , wherein the endpoint manager is further configured to inject a domain name system (DNS) record into the virtual execution environment, wherein the DNS record associates the network-based service with an IP address of the virtual private cloud endpoint.
5. A computer-implemented method comprising:
under control of an on-demand code execution system hosted within a cloud provider network in communication with a public internet, the on-demand code execution system comprising one or more computer processors configured to execute specific instructions:
receiving an opt-in request to opt-in to use a private communication path within the cloud provider network for traffic initiated by a function;
subsequent to receiving the opt-in request, receiving a function invocation request to invoke the function, wherein the function is configured to send one or more communications to a network-based service hosted within the cloud provider network and external to the on-demand code execution system;
providing, to a virtual execution environment configured to execute the function, a mapping of the network-based service to an internet protocol (IP) address of a private endpoint associated with the on-demand code execution system, wherein the private endpoint is configured to route network traffic within the cloud provider network using only one or more private IP addresses of the cloud provider network, and wherein the public internet is inaccessible via the private endpoint; and
causing execution of the function by the virtual execution environment, wherein a network communication to the network-based service initiated by the function is sent to the private endpoint based on the mapping of the network-based service to the IP address.
6. The computer-implemented method of claim 5 , wherein receiving the opt-in request comprises receiving the opt-in request from one of: a function owner of the function, or a function invoker of the function.
7. The computer-implemented method of claim 5 , further comprising storing an opt-in record regarding the opt-in request in an endpoint configurations data store, wherein the opt-in record specifies the function and the network-based service to which communications initiated by the function are to be communicated over the private communication path.
8. The computer-implemented method of claim 5 , further comprising storing an opt-in record regarding the opt-in request in an endpoint configurations data store, wherein the opt-in record specifies that all communications initiated by the function are to be communicated over the private communication path.
9. The computer-implemented method of claim 5 , wherein providing, to the virtual execution environment, the mapping of the network-based service to the IP address of the private endpoint comprises providing a mapping record to a local domain name system (DNS) server in the virtual execution environment.
10. The computer-implemented method of claim 5 , further comprising routing a second communication initiated by the function to a second network-based service through an internet gateway using a public IP address accessible via the public internet.
11. The computer-implemented method of claim 5 , further comprising:
receiving a second function invocation request to invoke a second function, wherein the second function invocation request is received from a same function invoker as the function invocation request, and wherein the opt-in request applies to all network-based services with which functions invoked by the function invoker communicate;
providing, to a second virtual execution environment configured to execute the second function, the mapping of the network-based service to the IP address of the private endpoint; and
causing execution of the second function by the second virtual execution environment, wherein a second network communication to the network-based service initiated by the second function is sent to the private endpoint based on the mapping of the network-based service to the IP address.
12. The computer-implemented method of claim 5 , further comprising:
receiving a second function invocation request to invoke a second function, wherein the second function invocation request is received from a different function invoker than the function invocation request, and wherein no opt-in request associated with the second function has been received;
configuring a second virtual execution environment to execute the second function in response to the second function invocation request; and
causing execution of the second function by the second virtual execution environment, wherein a second network communication to the network-based service initiated by the second function is sent using a public IP address accessible via the public internet.
13. A computer-implemented method comprising:
under control of an on-demand code execution system hosted within a cloud provider network in communication with a public internet, the on-demand code execution system comprising one or more computer processors configured to execute specific instructions:
receiving an opt-in request to opt-in to use a private communication path within the cloud provider network for traffic initiated by a function;
subsequent to receiving the opt-in request, receiving a function invocation request to invoke the function, wherein the function is configured to send one or more communications to a network-based service hosted within the cloud provider network and external to the on-demand code execution system;
causing execution of the function by a virtual execution environment, wherein during execution of the function, a domain name system (DNS) request associated with the network-based service is generated; and
providing, to the virtual execution environment in response to the DNS request, a first internet protocol (IP) address of a private endpoint associated with the on-demand code execution system instead of a second IP address by which the network-based service is accessible via the public internet, wherein the private endpoint is configured to route network traffic within the cloud provider network using only one or more private IP addresses of the cloud provider network, and wherein the public internet is inaccessible via the private endpoint.
14. The computer-implemented method of claim 13 , wherein receiving the opt-in request comprises receiving the opt-in request from one of: a function owner of the function, or a function invoker of the function.
15. The computer-implemented method of claim 13 , further comprising storing an opt-in record regarding the opt-in request in an endpoint configurations data store, wherein the opt-in record specifies the function and the network-based service to which communications initiated by the function are to be communicated over the private communication path.
16. The computer-implemented method of claim 13 , further comprising storing an opt-in record regarding the opt-in request in an endpoint configurations data store, wherein the opt-in record specifies that all communications initiated by the function are to be communicated over the private communication path.
17. The computer-implemented method of claim 13 , further comprising determining, in response to the DNS request, that the opt-in request has been received.
18. The computer-implemented method of claim 13 , further comprising providing, to the virtual execution environment in response to a second DNS request associated with a second network-based service, a second IP address accessible via the public internet.
19. The computer-implemented method of claim 13 , further comprising:
receiving a second function invocation request to invoke a second function, wherein the second function invocation request is received from a same function invoker as the function invocation request, and wherein the opt-in request applies to all network-based services with which functions invoked by the function invoker communicate; and
causing execution of the second function by a second virtual execution environment, wherein a second network communication to the network-based service initiated by the second function is sent to the private endpoint based on the first IP address.
20. The computer-implemented method of claim 13 , further comprising:
receiving a second function invocation request to invoke a second function, wherein the second function invocation request is received from a different function invoker than the function invocation request, and wherein no opt-in request associated with the second function has been received;
configurating a second virtual execution environment to execute the second function in response to the second function invocation request; and
causing execution of the second function by the second virtual execution environment, wherein a second network communication to the network-based service initiated by the second function is sent using a public IP address.