fix: restrict private cloud destination connections

[TroyCoombs]

Summary

Authenticated destination managers could point cloud destination clients at private or local services reachable from an Outpost worker. Add a shared connection-time address policy for AWS EventBridge, Kinesis, SQS, S3, and GCP Pub/Sub. It checks the resolved IPv4/IPv6 address immediately before each TCP connection, including connections after AWS redirects, and applies when publishers are created for existing records.

• Reject forbidden literal endpoints during validation and block private hostname resolutions at connection time.
• Cover SQS's queue_url when it determines the endpoint, and reject unsupported Pub/Sub resolver schemes.
• Keep public custom endpoints supported. Allow private VPC endpoints and emulators only through deployment-owned DESTINATIONS_CLOUD_ALLOWED_CIDRS.
• Disable environment proxies for these delivery transports so remote DNS resolution cannot bypass the local address check.

The report is valid at the source/provider level. Recommended priority is P2 / Medium, provisional pending confirmation of the deployed version and effective production egress controls. The submitted evidence does not establish secret-key theft, platform credential compromise, cross-tenant data exposure, or privileged internal actions.

Reply to the reporter (draft; not sent)

Thank you for reporting this issue and for providing the reproduction details. We confirmed a server-side request forgery weakness in Outpost's custom cloud-destination endpoint handling and reproduced access to a local test endpoint.

Based on the evidence currently available, our assessment is P2 (Medium). The report demonstrates control over the destination of a server-side request, but does not demonstrate disclosure of AWS secret keys or platform credentials, access to another customer's data, or a privileged action against an internal service. The access key ID and event payload observed in the example were supplied as part of the test.

We have prepared a fix for review that checks destination addresses when connections are opened, with explicit operator controls for legitimate private endpoints. The fix has not yet been deployed. We will reassess the priority if additional evidence establishes a higher impact.

Thank you again for helping us improve Outpost's security.

Compatibility and rollout

• On both API and delivery services, configure the smallest necessary DESTINATIONS_CLOUD_ALLOWED_CIDRS ranges before upgrading deployments that use private endpoints. This applies to existing destinations as well.
• AWS and Pub/Sub delivery connections no longer honor HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY. The existing DESTINATIONS_PROXY_URL coverage is unchanged.
• Pub/Sub emulator targets must use host:port.
• Keep network egress controls in place. This patch addresses delivery endpoint connections; it is not a repository-wide SSRF audit.

Validation

Passed in disposable Linux containers using Go 1.27.2:

• git diff --cached --check
• go test -p 2 ./internal/destregistry/... ./internal/config -short -count=1
• go test -p 2 ./... -short -count=1
• With external networking disabled: go test -p 2 ./internal/destregistry/... -short -count=1 -v -run "^(TestCloud|TestSQSQueueURL|TestPubSubEndpointConnectionPolicy)"

The new cases exercise all five actual providers against local receivers: forbidden private destinations receive no requests, and explicitly allowed emulators successfully receive deliveries. Additional cases cover mapped IPv6, link-local/metadata addresses, hostname resolution, 307/308 redirects, environment-proxy configuration, SQS queue URLs, existing records, tenant attempts to override the deployment policy, and environment/YAML configuration.

An initial run hit an existing registry TTL timing test under higher parallel load; it passed unchanged with -p 2. Live cloud accounts, production endpoints, and the full external-broker integration suite were not exercised.