Skip to content

docs(PM-6095): document ECS network access for support uploads #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jmgasper wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

docs(PM-6095): document ECS network access for support uploads #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,23 @@ before installation. Keep this patch when upgrading the SDK until the upstream
transport handles these cases; `filestack-http.spec.ts` exercises the installed
adapter, cancellation, interrupted responses, and a complete 2 MiB body.

### ECS outbound network access

The ECS task must be able to complete HTTPS connections to
`upload.filestackapi.com` and the regional `upload-<region>.filestackapi.com`
endpoints selected by Filestack. In an AWS Network Firewall domain allowlist,
the `.filestackapi.com` suffix covers these endpoints. The task also needs
access to the storage endpoint returned by Filestack; the current dev app
selects an S3 host covered by the existing `.amazonaws.com` allowlist entry.

A permitted TCP connection alone does not establish HTTPS connectivity. A
firewall can drop the TLS handshake based on its server name before the upload
request is sent. This produces the bounded 503 response after
`OUTBOUND_HTTP_TIMEOUT_MS`, even for tiny files. Check Network Firewall alert
logs for blocked `upload.filestackapi.com` TLS traffic before increasing the
timeout. Verify changes with an upload from the ECS network, since a successful
upload from a developer machine does not exercise the same firewall rules.

## Data model and unread behavior

Prisma owns a dedicated PostgreSQL `support` schema. The initial migration
Expand Down