Network & IAM

What the appliance exposes, what it connects to by itself, and exactly what its IAM role can do in your account.

Network

Inbound

Port	Open to	Notes
`443`	Everyone	HTTPS: the console and the MCP endpoint.
`80`	Everyone	Redirects to 443. It also serves the ACME HTTP-01 challenge when you set a domain.
`22`	Only the `AdminCidr` you supplied at launch	SSH. You can also reach the instance through Session Manager (see Operations).

The instance requires IMDSv2 for the instance metadata service; IMDSv1 is disabled.

The platform's own AWS calls authenticate as the IAM role this stack creates for the instance (the template creates no access keys); see IAM role below for exactly what it can do and why.

Outbound

Outbound traffic is not restricted by the security group. By itself the appliance connects to:

AWS services in your account, as the instance role: Amazon DynamoDB, Amazon S3, Amazon SQS, Amazon Bedrock and Amazon Textract (see IAM role), AWS STS for the health panel's identity check, and AWS Systems Manager for Session Manager.
Let's Encrypt, to issue and renew the certificate once you set a domain.
What its Ubuntu 24.04 operating system calls on its own, for example Ubuntu's package servers (automatic security updates) and the Docker and Caddy package repositories (package lists), the Snap Store (the Systems Manager agent is a snap, which Ubuntu keeps up to date from there), and time synchronisation. Ubuntu's news and telemetry timers (the message of the day news, firmware metadata, crash reports, the Ubuntu Pro client and the update notifier) are turned off.

Beyond those it connects to what you set up or ask for, for example:

The MCP servers and REST APIs you register, including an API description (an OpenAPI document) you point it at when you add a REST API (see Register MCP servers).
Amazon CloudWatch, with the access key you enter, if you connect the AWS CloudWatch extension.
A browser's push service, for a user who turns on notifications.
Brave Search, and the pages the web_extract tool is asked to fetch, once you set a Brave Search API key (see Web search).

IAM role

The template creates one IAM instance role and attaches it to the instance through an instance profile. The platform's own AWS calls authenticate as this role; the template creates no access keys. Its inline policy grants only the actions something on the instance actually calls: no action is a wildcard, and every statement except TextractImageText and BedrockInferenceProfiles is scoped to the resources this stack creates or to Amazon Bedrock models and your account's inference profiles, with no hard-coded account or Region.

Statement (Sid)	What it grants, and why
`PlatformTables`	Read and write items in the five DynamoDB tables and their indexes (console, gateway, orchestrator).
`PlatformBuckets`	List the media, RAG and backups buckets: the console lists a folder before deleting it, and `appxenctl backup list` lists the backups. The grant on the backups bucket deliberately has no prefix condition: a share link looks up candidate keys, and S3 reports a missing key as `NoSuchKey` (so the share link answers 404 Not Found) only to a caller that may list the bucket; otherwise S3 answers AccessDenied and the share link fails with a server error.
`MediaAndRagObjects`	Read, write, delete and abort multipart uploads on objects in the media and RAG buckets (uploaded files and RAG documents).
`PostgresBackups`	Read, write and abort multipart uploads under the backups bucket's `postgres/` prefix only: `appxenctl backup now` (and the nightly backup) writes a dump there, and `appxenctl restore` reads one back after writing a safety dump next to it. `appxenctl backup list` lists the prefix through `PlatformBuckets`. There is no delete permission: old backups expire only through the bucket's lifecycle rule.
`SharedOutputs`	Read, write and delete objects under the backups bucket's `shared/` prefix only, for the orchestrator's share links (write, read, unshare).
`RagJobQueues`	Send, receive and delete messages on the RAG job queue, for the RAG engine's uploads and its background worker. The role has no access to the dead-letter queue: SQS moves failed messages there itself.
`BedrockInvoke`	Invoke foundation models on your own Amazon Bedrock, directly or through inference profiles in this account. The foundation-model resource allows any Region because the platform's default models are cross-Region inference profiles (for example `us.anthropic.claude-sonnet-4-5-20250929-v1:0`), which serve each request from the model in one of several Regions. Converse calls are authorized by `bedrock:InvokeModel`; there is no separate IAM action for them. Nothing on the instance streams responses, so `bedrock:InvokeModelWithResponseStream` is not granted.
`BedrockInferenceProfiles`	List the inference profiles offered in the stack's Region, once, at first boot, to map each default model to a profile that Region offers (see Before you launch: Amazon Bedrock model access). It reads profile metadata only and invokes nothing. `bedrock:ListInferenceProfiles` has no resource-level permissions, hence `Resource: "*"`.
`TextractImageText`	Detect text in images for the RAG engine's image parser. Textract has no resource-level permissions, hence `Resource: "*"`.

AmazonSSMManagedInstanceCore

AmazonSSMManagedInstanceCore is attached alongside the inline policy above, for on-box access through Session Manager and Run Command (used by the support path of this listing).

This policy is broader than the inline policy. It also grants ssm:GetParameter and ssm:GetParameters on every Systems Manager parameter in your account's Region, not just this stack's resources. That includes SecureString parameters encrypted with the default aws/ssm key, because that key's policy lets any principal authorised for Systems Manager decrypt through it. A SecureString under a customer-managed KMS key stays unreadable unless that key's policy grants this instance role.

Scoping this down to a minimal inline statement (ssm:UpdateInstanceInformation, ssmmessages:*Channel, ec2messages:*) is a follow-up.