Outbound connections on AWS

info

This information applies to Imply Lumi Enterprise deployments on AWS.

Imply Lumi Enterprise on AWS runs entirely within your AWS account. To support centralized monitoring, updates, and lifecycle management, several components in your deployment make outbound connections to Imply-hosted services.

This topic provides a reference for the outbound connections that Lumi Enterprise makes. Use it to configure firewall allowlists or restrict public internet egress.

Imply ECR

Amazon Elastic Kubernetes Service (EKS) worker nodes pull container images and Helm charts for Lumi Enterprise from the Imply Elastic Container Registry (ECR) account. The update-client pod also connects to ECR to check for and apply software upgrades. This connection is required for both initial deployment and future software upgrades.

• Endpoint: 029636175232.dkr.ecr.us-east-1.amazonaws.com
• Helm charts (OCI): oci://029636175232.dkr.ecr.us-east-1.amazonaws.com/helm/imply
• Docker images: 029636175232.dkr.ecr.us-east-1.amazonaws.com/docker/imply

The following table lists the connection details:

Field	Value
Protocol	HTTPS / 443
Auth	ECR authorization token using IRSA (ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:ListImages, ecr:GetDownloadUrlForLayer)
Initiator	All EKS worker nodes (image pulls), update-client (upgrades)
Region	Always us-east-1 regardless of deployment region

Update server

The update-client service in your deployment sends a deployment heartbeat to the Imply-hosted update server and polls the update server for changes to the Bill of Material (BOM). The BOM determines which version each Lumi Enterprise service runs.

Traffic to the update server stays on the AWS private backbone and doesn't traverse the public internet.

Endpoint: https://lumi-enterprise.imply.io

The following table lists the connection details:

Field	Value
Protocol	HTTPS / 443
Auth	Bearer IAM key (IAM_KEY / apiKey)
Initiator	update-client pod
Networking	Private. Goes through the AWS PrivateLink VPC interface endpoint provisioned by the Terraform module.

Lifecycle service

The ui-app backend and the iow-tenant service both call the lifecycle service:

• ui-app calls the lifecycle service to query account state for the explore view
• iow-tenant calls the lifecycle service for its own tenant-management operations

This connection goes over the public internet.

Endpoint: https://api.lumi.imply.io

The following table lists the connection details:

Field	Value
Protocol	HTTPS / 443
Auth	Bearer IAM key
Initiator	ui-app pod, which proxies account lookup, rename, and region calls. iow-tenant also calls this service directly, using its own REST client.
Networking	Public. No private path is currently configured by the Terraform module.

OpenTelemetry collector

By default, the opentelemetry-collector service sends the following telemetry data to Imply over the public internet:

• Logs: All pod and container logs across the cluster, filtered by verbosity. Lumi excludes kube-system and Kong 2XX logs.
• Metrics:
  • Pod and node CPU, memory, filesystem, allocatable resources
  • Kubernetes deployment, StatefulSet, container status metrics
  • Kafka consume lag, producer latency and errors, record send rates
  • Kong HTTP metrics
  • Apache® Druid pipeline and event ingestion metrics
  • S3 pull and AWS SDK call metrics

The collector gathers data every 60 seconds.

The same collector instance handles both logs and metrics.

• Logs endpoint: https://ent-logs.lumi.imply.io
• Metrics endpoint: https://cc.imply.io/otel/{customer_id}

The following table lists the connection details:

Field	Value
Protocol	OTLP over HTTPS / 443
Auth (logs)	Authorization: Bearer <api_key>
Auth (metrics)	Authorization: Basic base64(customer_id:api_key)
Initiator	opentelemetry-collector DaemonSet (per node) + Deployment (cluster-level) in kube-system
Networking	Public internet

To disable sending telemetry data to Imply, set the enable_telemetry Terraform variable to false.

AWS services

The connections described in this section target AWS resources within your account and region. These connections can stay fully private, without ever traversing the public internet.

The following table lists the AWS services that Lumi Enterprise components connect to:

AWS service	Port	Purpose	Auth
RDS Aurora1	3306 (TLS)	Control plane and data plane databases	IAM auth (rds-db:connect) using IRSA
MSK Kafka1	9098 (TLS)	Event streaming, ingest pipeline	IAM auth (kafka-cluster:*) using IRSA
S32	443	Deep storage (segment read and write)	IAM (s3:GetObject, s3:PutObject, etc.) using IRSA
Route 532	443	DNS record management (external-dns)	IAM using IRSA
SES (optional)2	443	Invitation and verification emails	IAM

¹ RDS and MSK are direct connections to database and broker instances running inside your own VPC. This table includes RDS and MSK because they're AWS-managed resources with their own authentication model, not because Lumi Enterprise calls an external AWS API to reach them.

² S3, Route 53, and SES are AWS regional service endpoints that Lumi reaches over the network, either privately through a VPC endpoint or over the public internet.

Egress allowlist

The following table provides an allowlist reference for restricting public internet egress. It lists the endpoints covered in this topic and whether a private path is available for those endpoints.

Endpoint	Purpose	Port	Initiator	Private path
029636175232.dkr.ecr.us-east-1.amazonaws.com	Container registry	443	All nodes, update-client	Yes
https://lumi-enterprise.imply.io	Update server	443	update-client	Yes
https://api.lumi.imply.io	Lifecycle	443	ui-app, iow-tenant	No
https://ent-logs.lumi.imply.io	Logs	443	opentelemetry-collector	No
https://cc.imply.io/otel/{customer_id}	Metrics	443	opentelemetry-collector	No
AWS service APIs	S3, Route 53	443	Various	Mixed1

¹ S3 supports a private path through AWS VPC endpoints. Route 53 requires the public internet.