<blockquote>
<p>In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe?</p>
</blockquote>
<p>The Bitcoin Core RPC interface is not designed to be accessed by untrusted networks. It's not secured against DoS attacks, nor does it have any encryption, so any network operator between the client and the server can read the username/password off the wire.</p>
<p>You should only ever set <code>rpcallowip</code> to local networks.</p>
<p>If you need to be accessible from elsewhere, use a VPN, or a tunnel like <code>stunnel</code>.</p>

CC BY-SA 4.0
2022-12-04T16:59:49.590Z
2022-12-04T16:59:49.590Z
Pieter Wuille
<p>Yes, it'd be perfectly fine.</p>
<p>Because, as you already know, you would restrict node access to both the desired AWS Lambda facilities and to any other AWS facilities you'd be using to query your AWS EC2 node (e.g. some other EC2 instance) by using AWS &quot;security groups&quot;.</p>
<p>The rest of the universe, including the rest of the AWS-verse, won't be able to query your EC2 node, as long as you code and assign your &quot;security groups&quot; correctly, and as far as there is no security issue at AWS (note this includes many things, like black-hat honeypots, inside jobs by rogue-y employees, govt mandates, any sort of bad stuff).</p>
<p>You can use AWS for relying and exploring transactions, but remember, not your hardware, not your coin.</p>

CC BY-SA 4.0
2022-12-04T12:56:58.307Z
Could you please elaborate a bit on how I could restrict node access to my desired AWS facilities using security groups?
tigeryant
CC BY-SA 4.0
2022-12-04T13:04:57.637Z
I'd rather not, it's been half a decade since I last used Lambda to process data coming from EC2, RDS...
Mercedes
CC BY-SA 4.0
2022-12-04T12:50:03.520Z
2022-12-04T12:56:58.663Z
2022-12-04T12:56:58.663Z
Mercedes
<p>I am trying to make RPC calls to my node from an AWS lambda function. Lambdas do not have a fixed set of ip address ranges. I know I can use a NAT gateway on AWS to give my lambdas a static ip, but this is expensive. In order to allow inbound RPC connections from my lambdas, would it be ok to set <code>rpcallowip=0.0.0.0/0</code>, so long as I keep my <code>rpcuser</code> and <code>rpcpassword</code> safe? Bear in mind, I do not use my node as a wallet.</p>

<json-rpc><full-node><bitcoin.conf>
Allow RPC connections from the internet to make RPC calls from Lambda?
tigeryant
# Allow RPC connections from the internet to make RPC calls from Lambda?

(Asked by: username_0 on 2022-12-04)

I am trying to make RPC calls to my node from an AWS lambda function. Lambdas do not have a fixed set of ip address ranges. I know I can use a NAT gateway on AWS to give my lambdas a static ip, but this is expensive. In order to allow inbound RPC connections from my lambdas, would it be ok to set `rpcallowip=0.0.0.0/0`, so long as I keep my `rpcuser` and `rpcpassword` safe? Bear in mind, I do not use my node as a wallet.

**Tags:** json-rpc, full-node, bitcoin.conf


---

## 2 answers

### Answer by username_1 on 2022-12-04. Score: 1 | Accepted answer

> In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe?

The Bitcoin Core RPC interface is not designed to be accessed by untrusted networks. It's not secured against DoS attacks, nor does it have any encryption, so any network operator between the client and the server can read the username/password off the wire.

You should only ever set `rpcallowip` to local networks.

If you need to be accessible from elsewhere, use a VPN, or a tunnel like `stunnel`.


---

### Answer by username_2 on 2022-12-04. Score: 0

Yes, it'd be perfectly fine.

Because, as you already know, you would restrict node access to both the desired AWS Lambda facilities and to any other AWS facilities you'd be using to query your AWS EC2 node (e.g. some other EC2 instance) by using AWS "security groups".

The rest of the universe, including the rest of the AWS-verse, won't be able to query your EC2 node, as long as you code and assign your "security groups" correctly, and as far as there is no security issue at AWS (note this includes many things, like black-hat honeypots, inside jobs by rogue-y employees, govt mandates, any sort of bad stuff).

You can use AWS for relying and exploring transactions, but remember, not your hardware, not your coin.

> **Comments:**
> **username_0**: Could you please elaborate a bit on how I could restrict node access to my desired AWS facilities using security groups?  
> **username_2**: I'd rather not, it's been half a decade since I last used Lambda to process data coming from EC2, RDS...  

---

