Disable Internet for ECS deploy runner

[99hacker]

There is one security concern points that we need to remove the NAT gateway from the management VPC so that in production environment it should be isolated. I did not get any of the documentation with respect to isolation. I would like to know if there is any way we can disable the internet.

One way I found if we can use the vpc endpoints to do so, but I do not know what endpoints are required to be created or does that have any impact on the deployment.

---

Tracked in ticket #110392

[ellisonc]

The ECS Deploy Runner uses the management VPC found at prod/<region>/mgmt/networking/vpc/terragrunt.hcl which alters the base configuration found at _envcommon/mgmt/vpc-mgmt.hcl. Cutting the ECS Deploy Runner off from the internet entirely will cause it to stop functioning as it requires access to terraform provider resources, any modules defined as remote git urls, any resources required by the dockerfiles it might build, and various gruntwork tools hosted on github. While it may be possible to restrict internet access in some way, this is not an officially supported use case. Removing internet access entirely from the ECS Deploy Runner is not supported.