Skip to main content
Evolving. This area is visible in the product, but it is still evolving and should not be treated like a fully mature surface yet.

​
Goal

Reach a legitimate external database or service through the smallest auditable network grant.

​
Prerequisites

  • A StackShift hosted project
  • The destination hostname and port
  • A connected node for private-only routes

​
Workflow

1
Open the project Security tab and review dependencies detected from configured environment variables.
2
Declare any missing destination using only hostname, port, protocol, purpose, and TLS requirements.
3
Request an exact destination grant with an expiry.
4
For a private-only endpoint, request a connected-node, VPN, or peering route and wait for approval.
5
Deploy after the dependency and route state are approved.

​
Supported dependency patterns

Exact hostname and port grants support public services such as Neon, Supabase, public AWS RDS, PlanetScale, Upstash, MongoDB Atlas, and equivalent providers. PostgreSQL, MySQL, Redis, MongoDB, SMTP, and generic TCP or TLS endpoints can be declared. StackShift parses configured connection strings inside the control plane and retains endpoint metadata only. Usernames, passwords, tokens, complete URLs, and raw environment values are not copied into grants, incidents, or network logs.

​
Grant rules

  • Destination-scoped grants can last up to 90 days.
  • Broad public-egress requests require explicit operator approval and expire within seven days.
  • Approval is an operator action; declaring a Terraform resource or calling an SDK never self-approves access.
  • Expired and revoked grants fail closed.

​
Terraform example

​
Private-only services

A private-only RDS instance or any RFC1918 destination cannot be reached from ordinary hosted egress. The project must target a connected node that already has an approved path through its VPC, VPN, or peering connection. StackShift validates the route before deployment and reports a waiting-for-network-approval state instead of letting the application fail later with an unexplained connection timeout.

​
Expected result

The workload can reach only the approved endpoint and port while credentials remain in the project environment rather than security records.

​
Common failures

  • A private RDS address has no approved route. Connect a node with the required private network path, VPN, or peering first.
  • The hostname resolves to a private, link-local, metadata, multicast, or otherwise protected address without an approved private route.
  • The grant expired. Request a replacement rather than widening the policy.
  • The provider rotates public addresses. Keep using the approved hostname so StackShift can reconcile its TTL-bound address set.

Hosted egress and admission

Understand the image admission receipt and restricted outbound network policy applied to hosted customer workloads.

Private networking and connections

Connect one service to another so StackShift injects the internal URL as an environment variable — no IPs or hostnames to copy, and private services never touch the public internet.

Provider resources and imports

Implementation reference for StackShift provider resources, import IDs, action semantics, and caveats.