user138297: I am trying to make RPC calls to my node from an AWS lambda function. Lambdas do not have a fixed set of ip address ranges. I know I can use a NAT gateway on AWS to give my lambdas a static ip, but this is expensive. In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe? Bear in mind, I do not use my node as a wallet.

user208: 
In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe?

The Bitcoin Core RPC interface is not designed to be accessed by untrusted networks. It's not secured against DoS attacks, nor does it have any encryption, so any network operator between the client and the server can read the username/password off the wire.
You should only ever set rpcallowip to local networks.
If you need to be accessible from elsewhere, use a VPN, or a tunnel like stunnel.

138297: <p>I am trying to make RPC calls to my node from an AWS lambda function. Lambdas do not have a fixed set of ip address ranges. I know I can use a NAT gateway on AWS to give my lambdas a static ip, but this is expensive. In order to allow inbound RPC connections from my lambdas, would it be ok to set <code>rpcallowip=0.0.0.0/0</code>, so long as I keep my <code>rpcuser</code> and <code>rpcpassword</code> safe? Bear in mind, I do not use my node as a wallet.</p>
 208: <blockquote>
<p>In order to allow inbound RPC connections from my lambdas, would it be ok to set rpcallowip=0.0.0.0/0, so long as I keep my rpcuser and rpcpassword safe?</p>
</blockquote>
<p>The Bitcoin Core RPC interface is not designed to be accessed by untrusted networks. It's not secured against DoS attacks, nor does it have any encryption, so any network operator between the client and the server can read the username/password off the wire.</p>
<p>You should only ever set <code>rpcallowip</code> to local networks.</p>
<p>If you need to be accessible from elsewhere, use a VPN, or a tunnel like <code>stunnel</code>.</p>
