Application Security Groups (ASGs) are a collections of egress rules that specify the protocols, ports, and IP address ranges where app or task instances send traffic. Apps Manager sets up rules to filter and log outbound network traffic from app and task instances in VMware Tanzu Application Service for VMs (TAS for VMs). ASGs apply to both buildpack-based and Docker-based apps and tasks.
When apps or tasks begin staging, they need traffic rules permissive enough to allow them to pull resources from the network. After an app or task is running, the traffic rules can be more restrictive and secure. To distinguish between these two security requirements, administrators can define one ASG for app and task staging, and another for app and task runtime. For more information about staging and running apps, see Application container lifecycle.
To provide granular control when securing a deployment, an administrator can assign ASGs to apply to all app and task instances for the entire deployment, or assign ASGs to spaces to apply only to apps and tasks in a particular space.
Only admin users can create and edit ASGs. For information about creating and configuring ASGs, see App Security Groups.
Displaying ASGs for a space
To view the ASGs associated with a space, follow these steps.
-
Log in to Apps Manager.
-
From the Home page, select the Org that contains the space you want to view.
-
Select the Space you want to view.
-
Click the Settings tab.
-
In the Security Groups section, Apps Manager displays ASGs associated with the selected space.
-
Click an ASG to expand its egress rules.
