Heroku Private Spaces are network-isolated application containers available to Heroku Enterprise customers. Private Spaces allow organizations to host applications within a secure, HIPAA-compliant environment. They are ideal for apps that handle PII and other legally regulated types of data.
When third party add-ons are included in your build, additional steps need to be taken in order for your data to maximize the benefit of a private space. Most add-ons are operated outside of Heroku’s VPC, which means your Private Space application will be communicating across the public internet. For some use cases this is unacceptable, which is why Bonsai proudly supports joining our networks together allowing your traffic to travel on the private backbone of AWS. Joining these networks together securely requires some careful networking, called peering.
Fortunately, both Heroku and Bonsai run on AWS infrastructure, which offers a service called VPC Peering. VPC Peering is a network connection between two VPCs that allows appliances within each VPC to communicate as though they were in a single network.
Be aware of your security model
Bonsai clusters come in one of two architectures: multitenant or single tenant. Clusters in the single tenant architectures (Business and Enterprise tiers) are running on private, sandboxed nodes. Clusters in the multitenant architecture (the Standard tier) are in an environment resources are shared among multiple users. As a result, shared tier clusters are not available for VPC Peering.
This may or may not be acceptable for the data you plan to index. The rest of this guide assumes you are running on a single tenant architecture.
VPC Peering can be set up between a Heroku Private Space and a Bonsai cluster on an Enterprise plan. This configuration will ensure maximum isolation and protection of your data.
Common Issues
Running in a Private Space has some additional implications that may not be immediately obvious. The main points are:
- The web Console will not be available, due to the fact that the Javascript is running outside of the private space. If you want to interface with your cluster directly, you'll need to connect to the VPC first.
- The Kibana dashboard will also be unavailable because the proxy is outside of the private space. Kibana can be set up within a private space, but it requires additional client-side configuration. Contact support@bonsai.io for more details.
- Connecting to the cluster directly will need to happen within the VPC itself, so users with a Private Space-based Bonsai cluster will need to first access their VPC before calls to Elasticsearch will succeed. See Connecting to Bonsai for more information.
If you run into any issues with your Private Space-based Elasticsearch cluster, please reach out to us at support@bonsai.io.
Gather your Heroku Peering Network Settings
In your Heroku Private Space you’ll need to navigate to the Network tab, and make a note of some settings under the Peering sub-section of the page. We need the AWS Account ID, the AWS VPC ID, and the AWS VPC CIDR. We will use this data to initiate a peering connection with your Heroku Space.
Finding Your Private Space URL
Your Private Space URL will look something like:
https://dashboard.heroku.com/teams//spaces//network
Enter your details into the Bonsai dashboard
Log into the Bonsai cluster dashboard by running $ heroku addons:open bonsai -a and enter your details in the form provided:
Accept our Peering Request
Once Bonsai has the above data, we will initiate a peering request to your space which will show up in the Network tab and under the Peering subsection. It should look like this:
Network changes are not instantaneous
The lead time for this to show up ranges from 30 minutes to a few hours.
When you accept the invitation the UI should change to look like:
Once the request has been accepted, you will be able to use the cluster URL provided in the Bonsai dashboard.
Private Means Private!
The DNS entry for your cluster will be pointing to private internal IP addresses, which means you will not be able to access this cluster except from within the Heroku Space. Browsers and curl commands will not work.