How do I harden the nodejs Lambda instrumentation, and what are the security implications of it listening on 0.0.0.0?

[lpsinger]

I instrumented a nodejs Lambda by following the instructions at https://aws-otel.github.io/docs/getting-started/lambda/lambda-js#enable-auto-instrumentation-for-your-lambda-function. In my AWS CloudWatch log for this Lambda, I see:

2023-01-17T17:12:17.705Z	warn	internal/warning.go:51	Using the 0.0.0.0 address exposes this server to every network interface, which may facilitate Denial of Service attacks	

What do I need to do to harden the Lambda auto-instrumentation for use in a production application? Is OpenTelemetry truly listening to endpoints that are reachable from the Internet, or is it locked down so that only CloudWatch can talk to it?

[tylerbenson]

I assume this isn't actually reachable in the same way you can't directly reach an individual lambda instance, but rather have to go through ELB or something.