Issues with using Guardrails in AWS within private networks

[AlejandroEsquivel]

If you're using an AWS instance or Sagemaker Notebook Instance located in a private subnet in AWS there can be a specific edge case that presents issues.

Namely, if you have a VPC interface endpoint for API Gateway, specifically in the us-east-1 region it may cause issues communicating with the Guardrails API as it won't go through the public internet to reach our servers and will cause it to be routed internally.

i.e Instead of the DNS resolution looking like:

Non-authoritative answer:
Name:	so4sg4q4pb.execute-api.us-east-1.amazonaws.com
Address: 3.234.204.126
Name:	so4sg4q4pb.execute-api.us-east-1.amazonaws.com
Address: 54.209.245.156

You get something like:

Non-authoritative answer:
Name:	so4sg4q4pb.execute-api.us-east-1.amazonaws.com
Address: 10.0.2.250

However if you're in another region (besides us-east-1) and also have a NAT gateway to reach the public internet you should be able to reach Guardrails API.

Future changes to Guardrails may fix this issue but the time being here we discuss potential workarounds for this.

[AlejandroEsquivel]

Some workarounds include:

1. Using a different region other than us-east-1
2. Disabling private DNS in your VPC Interface Endpoint for API Gateway (enables more granular control over DNS resolution, but care needs to be taken it doesn't have unwanted implications)

Feel free to suggest any others, we will be looking into making this experience better and provide updates if any arise.

[AlejandroEsquivel]

As of v0.5.3 this should be resolved. You will not need to make networking changes to reach the guardrails server from private networks.