Private Spaces and VPC Peering

Heroku Private Spaces are network-isolated application containers available to Heroku Enterprise customers. Private Spaces allow organizations to host applications within a secure, HIPAA-compliant environment. They are ideal for apps that handle PII and other legally regulated types of data.

When third party add-ons are included in your build, additional steps need to be taken in order for your data to maximize the benefit of a private space. Most add-ons are operated outside of Heroku’s VPC, which means your Private Space application will be communicating across the public internet. For some use cases this is unacceptable, which is why Websolr proudly supports joining our networks together allowing your traffic to travel on the private backbone of AWS. Joining these networks together securely requires some careful networking, called peering.

Fortunately, both Heroku and Websolr run on AWS infrastructure, which offers a service called VPC Peering. VPC Peering is a network connection between two VPCs that allows applications within each VPC to communicate as though they were in a single network.

Be aware of your security model

Websolr indexs come in one of two architectures: multitenant or single tenant. Indices in the single tenant architectures (Business and Enterprise tiers) are running on private, sandboxed nodes. Indices in the multitenant architecture (the Standard tier) are in an environment resources are shared among multiple users. As a result, shared tier indices are not available for VPC Peering.

This may or may not be acceptable for the data you plan to index. The rest of this guide assumes you are running on a single tenant architecture.

VPC Peering can be set up between a Heroku Private Space and a Websolr index on an Enterprise plan. This configuration will ensure maximum isolation and protection of your data.

Gather your Heroku Peering Network Settings

In your Heroku Private Space you’ll need to navigate to the Network tab, and make a note of some settings under the Peering sub-section of the page. We will use this data to initiate a peering connection with your Heroku Space.

Finding Your Private Space URL

Your Private Space URL will look something like:

https://dashboard.heroku.com/teams/ /spaces/ /network

Accept our Peering Request

Once Websolr has the above data, we will initiate a peering request to your space which will show up in the Network tab and under the Peering subsection. It should look like this:

Network changes are not instantaneous

The lead time for this to show up ranges from 30 minutes to a few hours.

When you accept the invitation the UI should change to look like:

Once the request has been accepted, you will be able to use the index URL provided in the Websolr dashboard.

Private Means Private!

The DNS entry for your index will be pointing to private internal IP addresses, which means you will not be able to access this index except from within the Heroku Space. Browsers and curl commands will not work.