Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How to restrict ingress traffic to Lightsail Container only from Cloudflare IP ranges?

0

Hi everyone,

I'm running a Django application in an AWS Lightsail container service, exposed via a custom domain managed by Cloudflare DNS, which proxies requests to the Lightsail Container public endpoint. Despite using Cloudflare as a reverse proxy (with "proxied" DNS records), I’m still experiencing DDoS attacks hitting my container's public endpoint. Upon inspecting the NGINX logs, I see requests coming in with internal AWS IPs (e.g., 172.26.x.x), and many of them list the Lightsail public container endpoint (e.g., vgpdne5ck4i8a.eu-central-1.cs.amazonlightsail.com) in the referrer or host.

I want to ensure that only Cloudflare can access my container. In the Lightsail Instance service I can restrict incoming HTTP traffic by IP range. However, Lightsail containers don’t expose any similiar setting.

Is it possible to restrict ingress traffic to my Lightsail container so only Cloudflare IPs can access it?

Any advice, examples, or experience would be appreciated! Thanks in advance! 🙏

Topics
ComputeSecurity, Identity, & ComplianceContainersNetworking & Content Delivery
Tags
DDOS ProtectionContainersNetworking & Content DeliveryAmazon Lightsail
Language
English
asked 8 months ago119 views
1 Answer
0

Hello.

Unfortunately, as of July 2025, there is no setting to restrict IP addresses for Lightsail containers.
If you want to restrict IP addresses, you will need to migrate to ECS and use security groups, etc.
Alternatively, you can migrate to AppRunner and use AWS WAF.
https://docs.aws.amazon.com/apprunner/latest/dg/waf.html

EXPERT
answered 8 months ago
AWS
EXPERT
reviewed 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content