Manage IP Filters on Confluent Cloud

Use IP filters to enhance the security of your Confluent Cloud resources by restricting access to trusted source IP addresses. IP filters use IP groups to streamline the organization of CIDR blocks into meaningful groups of source IP addresses that can access your Confluent Cloud resources. If an incoming IP address is associated with an allowed IP group, access is granted; otherwise, access is denied. By leveraging IP groups, IP filters can effectively enforce granular access control policies and help safeguard your Confluent Cloud resources from unauthorized access.

The sections below describe how to use the Confluent Cloud Console, Confluent CLI, and Confluent Cloud APIs to create, update, describe, list, and delete IP filters.

Additionally, see the following related content:

Create an IP filter

Before you can create an IP filter, you must have at least one IP group. An IP group defines a set of IP addresses that can access Confluent Cloud resources. To create an IP group, see Create an IP group.

Add an IP filter to control access to resources in your Confluent Cloud organization only from client IP addresses included within specified IP groups.

When an IP filter is assigned to an organization, it applies to every request to the organization, not only to specific groups of users.

Important

The first IP filter you create must include an IP group that covers the IP address of your client. To prevent you from locking yourself out of your Confluent Cloud resources, you are blocked from creating an IP filter if an existing IP filter does not include your client IP address.

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters . The IP filter view appears.

  3. Click Add IP filter. The Add IP filter page appears.

  4. In the IP filters field, enter a name for the IP filter.

  5. In the IP groups field of the Apply IP groups section, select the IP groups that are allowed to access this resource.

  6. In the Scope section, the scope is set to management, which is currently the only supported scope value.

    The management scope includes the management of resources in your Confluent Cloud organization, but does not include operations on those resources, such as producing and consuming messages.

  7. Click Save and enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, IP filter ID, and IP groups.

Update an IP filter

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters . The IP filter view appears.

#. In the table of IP filters, click the name of the IP filter that you want to update. The IP filter details page appears.

  1. Click Edit IP filter. The IP filter fields appear.
  2. Edit the values of your IP filter name, IP groups, and Scope, as needed, and click Save.

The IP filter is updated and the updated IP filters list reappears.

Describe an IP filter

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters. The IP filters view appears.

  3. Click the name of the IP filter that you want to view. The IP filter details page appears, showing the IP filter name, IP filter ID, and IP groups.

To return to the list of IP filters, click “IP filtering” in the breadcrumb navigation at the top of the page.

List IP filters

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters. The IP filters view appears.

You can click an IP filter name to view the details.

Delete a IP filter

IP filters can be deleted to remove access to Confluent Cloud resources. You can also update an IP filter to remove an IP group from access.

Important

Deleting a IP filter removes the IP filter from your organization. If you delete a IP filter that is assigned to a network, the IP addresses in that network can no longer access to the resources that the IP filter controls.

If all IP filters are removed, authorized users from any source IP address can access resources in your organization.

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP group view, appears.

  2. Click IP filter. The IP filter view appears.

  3. Click the IP filter name for the IP filter you want to delete. The IP filter details page appears.

  4. Click Delete IP filter. The Delete IP filter dialog appears.

  5. After confirming that you want to delete the specified IP filter, enter the IP filter name in the IP filter name field and click Confirm.

The IP filter is deleted and the Accounts & access page appears listing the remaining IP filters.

Related content