Manage IP Filters on Confluent Cloud

Use IP filters to enhance the security of your Confluent Cloud resources by restricting access to trusted source IP addresses. IP filters use IP groups to streamline the organization of CIDR blocks into meaningful groups of source IP addresses that can access your Confluent Cloud resources. If an incoming IP address is associated with an allowed IP group, access is granted; otherwise, access is denied. By using IP filters, you can effectively enforce access control policies and help safeguard your Confluent Cloud resources from unauthorized access.

IP filters only impact requests from outside Confluent Cloud because they only restrict public access, not private networking access. IP filters do not impact requests from within Confluent Cloud such as cluster links or fully-managed connectors.

Prerequisites

To manage IP filters in the Confluent Cloud Console, you must meet the following prerequisites:

A Confluent Cloud account with the OrganizationAdmin role to manage IP filters for your entire organization or the EnvironmentAdmin role to manage IP filters for your environment.
To use the confluent iam ip-filter CLI command, you must have Confluent CLI version 4.18.0 or later.

Create an IP filter

IP filters allow access by referring to one or more IP groups, which define sets of known IP addresses. To create an IP group, see Create an IP group.

You must also specify the operation groups that your IP filter applies to. The included operation groups define which operations the IP filter affects. For details, see Operation groups.

Important

The first IP filter you create, named Management, includes the operation group for resource management and must include an IP group that covers the IP address of your client.

You cannot make changes that would lock you out. If you create, update, or delete an IP filter, or update an IP group, such that your calling IP address would be blocked from making further changes, the request fails with an error. For more details and a tip on how to specify a CIDR block for your current IP address, see Specify CIDR blocks for IP groups.

The lockout check evaluates the resource management operation group at the organization and environment scope, so a change is rejected if your IP address would be blocked at either scope.

You can add an IP filter to control access to your entire organization or to a specific environment in your Confluent Cloud organization. If you create an IP filter for a specific environment, it adds restrictions specific to that environment while still enforcing any organization-level filters. For details, see Resource scopes.

Confluent Cloud Console organization

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP groups view, appears.
Click IP filters. The IP filter view appears.
Click Add IP filter. The Add IP filter page appears.
In the IP filters field, enter a name for the IP filter.
In the Access section, select Allow specific IP groups.
In the IP groups field, select the IP groups that are allowed to access this resource. You must include at least one IP group.
In the Operation groups section, select the operation groups that are allowed to access this resource.
Click Save and Enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, operation groups, IP filter ID, and IP groups.

Confluent Cloud Console environment

From your environment, go to Network management and then the For public networks tab. The IP filtering section appears.
Click Add IP filter. The Add IP filter page appears.
In the IP filters field, enter a name for the IP filter.
In the Access section, select Allow specific IP groups.
In the IP groups field, select the IP groups that are allowed to access this resource. You must include at least one IP group.
In the Operation groups section, select the operation groups that are allowed to access this resource.
Click Save and Enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, operation groups, IP filter ID, and IP groups.

Confluent CLI organization

Use the confluent iam ip-filter create command (Confluent CLI reference) to create an IP filter.

For example, the following command creates an IP filter named US Offices that allows access to the management operation group for the ipg-12345 and ipg-67890 IP groups. The --operations flag is optional and defaults to the management operation group.

confluent iam ip-filter create "US Offices" \
  --ip-groups ipg-12345,ipg-67890 \
  --operations management

The following example shows the response to the request:

+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcde                                                               |
| Name             | US Offices                                                              |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-12345, ipg-67890                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3445-1865-4e27-9fe5-c23a58e96a10 |
+------------------+-------------------------------------------------------------------------+

Note

The Resource Group field shows “multiple” because the IP filter uses the Operation Groups field to declare the operations it covers. The Confluent CLI sends multiple unless you set --resource-group management. --resource-group and --operations are mutually exclusive.

The Resource Scope field shows that this IP filter applies to the entire organization.

To add an IP filter that allows access to schema management in Confluent Cloud, use the confluent iam ip-filter create command with the appropriate flags.

confluent iam ip-filter create "schema management access" \
  --operations schema \
  --ip-groups ipg-123abc,ipg-456def

The following example shows the response to the request:

+------------------+-------------------------------------------------------------------------+
| ID               | ipf-ek2le                                                               |
| Name             | schema management access                                                |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-123abc, ipg-456def                                                  |
| Operation Groups | SCHEMA                                                                  |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3445-1865-4e27-9fe5-c23a58e96a10 |
+------------------+-------------------------------------------------------------------------+

In this command:

schema management access is the name of the IP filter you are creating.
--operations schema specifies that the filter applies to schema management operations.
--ip-groups ipg-123abc,ipg-456def lists the IP groups that are allowed access.

Confluent CLI environment

To apply an IP filter to a specific environment, you can add the --environment parameter:

confluent iam ip-filter create "schema management access" \
  --environment env-987xyz \
  --operations schema \
  --ip-groups ipg-123abc,ipg-456def

If you do not specify an environment, the IP filter applies to the entire organization.

The following example shows the response to the request:

+------------------+------------------------------------------------------------------------------------------------+
| ID               | ipf-3g793                                                                                      |
| Name             | schema management access                                                                       |
| Resource Group   | multiple                                                                                       |
| IP Groups        | ipg-123abc, ipg-456def                                                                         |
| Operation Groups | SCHEMA                                                                                         |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/environment=env-987xyz |
+------------------+------------------------------------------------------------------------------------------------+

The Resource Scope field shows the environment to which this IP filter applies. Environment-level filters can only add additional restrictions on top of organization-level filters, which act as your baseline policy. Requests must satisfy both levels of filtering to be allowed access.

Confluent Cloud APIs

To make a request to create an IP filter, use the POST /iam/v2/ip-filters API endpoint. For more information, see Create an IP Filter.

Note

The PATCH method requires that you include all attributes in the request body, not just the attributes that you want to update.

For example, the following request creates an IP filter named US Offices that allows access to the MANAGEMENT operation group for the IP groups ipg-3rrky and ipg-wvppw.

curl --request POST \
  --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"US Offices","resource_group":"multiple","operation_groups":["MANAGEMENT"],"ip_groups":[{"id":"ipg-3rrky"},{"id":"ipg-wvppw"}]}'

These are the field values in this request:

The filter_name field is the name of the IP filter. It is required.
The ip_groups field is a required array of IP group references that are allowed access. Each entry sets id to an IP group ID. Provide between 1 and 25 IP groups.
The resource_group field is required and must be set to multiple to indicate to use the operation_groups for the IP filter.
The operation_groups field is required when resource_group is multiple and must list at least one operation group. See Identifiers.
The resource_scope field is optional and defaults to the organization. If you specify an environment, the IP filter applies to that environment.

The following example shows the response to the request:

{
  "api_version": "iam/v2",
  "filter_name": "US Offices",
  "id": "ipf-3zpje",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:34:02.906282Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-3zpje",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-3zpje",
    "updated_at": "2025-03-15T22:34:02.906282Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}

Terraform

Create an IP filter by using the Confluent Terraform provider. For more information, see confluent_ip_filter Resource.

Block all public networks

Blocking all public networks prevents access from any public network for the defined operation groups. When creating your IP filter, you can select Block all public networks for access. Select this option using any of the following interfaces:

Confluent Cloud Console organization

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP groups view, appears.
Click IP filters. The IP filter view appears.
Click Add IP filter. The Add IP filter page appears.
In the IP filters field, enter a name for the IP filter.
In the Access section, select No public networks.

This option excludes all public IP addresses, allowing access only from private network connections.
- To allow no public network access, use this option with only one IP filter per operation group.
- When you select No public networks, you can’t also select specific IP groups.
In the Operation groups section, select the operation groups that are allowed to access this resource.
Click Save and Enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, operation groups, IP filter ID, and IP groups.

Confluent Cloud Console environment

From your environment, go to Network management and then the For public networks tab. The IP filtering section appears.
Click Add IP filter. The Add IP filter page appears.
In the IP filters field, enter a name for the IP filter.
In the Access section, select No public networks.

This option excludes all public IP addresses, allowing access only from private network connections.
- To allow no public network access, use this option with only one IP filter per operation group.
- When you select No public networks, you can’t also select specific IP groups.
In the Operation groups section, select the operation groups that are allowed to access this resource.
Click Save and Enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, operation groups, IP filter ID, and IP groups.

Confluent CLI

To prevent access from public networks, use the --no-public-networks flag. The following example shows how to create an IP filter that prevents access from public networks, but allows access to the schema operation group:

confluent iam ip-filter create "No Public Access" \
  --no-public-networks \
  --operations schema

The following example shows the response to the request:

+------------------+-------------------------------------------------------------------------+
| ID               | ipf-wjqxe                                                               |
| Name             | No Public Access                                                        |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-none                                                                |
| Operation Groups | SCHEMA                                                                  |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+

Note

These are the field values in this response:

The Resource Group field shows “multiple” because the IP filter uses the Operation Groups field to declare the operations it covers.
The Resource Scope field shows that this IP filter applies to the entire organization.
The IP Groups field shows “ipg-none”, which is the predefined IP group that prevents access from public networks.
The Operation Groups field shows “SCHEMA” because the IP filter applies to the schema operation group. The Operation Groups field might not include the “management” operation group when you use the --no-public-networks flag because it would block all access to manage your own Confluent Cloud organization.

Confluent Cloud APIs

To prevent access from public networks, set the only ip_groups entry to the system-defined ipg-none IP group.

curl --request POST \
  --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"No Public Access","resource_group":"multiple","operation_groups":["SCHEMA"],"ip_groups":[{"id":"ipg-none"}]}'

These are the field values in this request:

The ip_groups field contains a single entry whose id is ipg-none. You can’t combine ipg-none with any other IP group in the same IP filter.
The operation_groups field can’t include MANAGEMENT when you use ipg-none.
The resource_group field is required and must be set to multiple to indicate to use the operation_groups for the IP filter.
The resource_scope field is optional and defaults to the organization. If you specify an environment, the IP filter applies to that environment.

The following example shows the response to the request:

{
  "api_version": "iam/v2",
  "filter_name": "No Public Access",
  "id": "ipf-3zpje",
  "ip_groups": [
    {
      "id": "ipg-none",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-none",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-none"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:34:02.906282Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-3zpje",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-3zpje",
    "updated_at": "2025-03-15T22:34:02.906282Z"
  },
  "operation_groups": [
    "SCHEMA"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}

When you create an IP filter that blocks all public networks, the following constraints apply:

For each operation group, an IP filter that blocks all public networks cannot be combined with any other IP filters.
When blocking all public networks, you cannot include any other IP group in the same IP filter.
You cannot block all public networks for the Management operation group because it doesn’t support private networking. This protects you from blocking all access.

Update an IP filter

Confluent Cloud Console

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP groups view, appears.
Click IP filters. The IP filter view appears.

#. In the table of IP filters, click the name of the IP filter that you want to update. The IP filter details page appears.

Click Edit IP filter. The IP filter fields appear.
Edit the values of your IP filter name, IP groups, and Operation groups, as needed, and click Save.

The IP filter is updated and the updated IP filters list reappears.

Confluent CLI

Use the confluent iam ip-filter update command (Confluent CLI reference) to update an IP filter. You must specify at least one of the following flags:

--name: A new name for the IP filter.
--add-ip-groups and --remove-ip-groups: A comma-separated list of IP groups to add to or remove from the IP filter.
--add-operation-groups and --remove-operation-groups: A comma-separated list of operation groups to add to or remove from the IP filter.
--resource-group: The resource group, either management or multiple.

You can’t change the resource scope of an existing IP filter. The resource scope is immutable after the IP filter is created.

For example, the following command updates the name of the IP filter to India Offices.

confluent iam ip-filter update ipf-abcef \
  --name "India Offices"

The following example shows the response to the request:

+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcef                                                               |
| Name             | India Offices                                                           |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-3rrky, ipg-wvppw                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+

In this example, the IP filter is updated to show the name India Offices.

The following command adds an IP group and the SCHEMA operation group to the same IP filter:

confluent iam ip-filter update ipf-abcef \
  --add-ip-groups ipg-4abcd \
  --add-operation-groups SCHEMA

You can’t remove every IP group from an IP filter. If you do, the command fails with Cannot remove all IP groups from IP filter.

Confluent Cloud APIs

To make a request to update an IP filter, use the PATCH /iam/v2/ip-filters/{id} API endpoint (see Update an IP Filter).

For example, the following request updates the name of the IP filter to India Offices.

curl --request PATCH \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-abcef' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"India Offices","resource_group":"multiple","operation_groups":["MANAGEMENT"],"ip_groups":[{"id":"ipg-3rrky"},{"id":"ipg-wvppw"}]}'

These are the field values in this request:

The ip_groups field replaces the existing list of IP groups. Include every IP group that the IP filter should reference, not only the ones you are adding.
The operation_groups field also replaces the existing list. Omit the field to leave the operation groups unchanged. An empty list isn’t supported.
The resource_scope field can’t be updated. The resource scope is immutable after the IP filter is created.

The following example shows the response to the request, with the updated filter name India Offices:

{
  "api_version": "iam/v2",
  "filter_name": "India Offices",
  "id": "ipf-abcef",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:44:19.045344Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
    "updated_at": "2025-03-15T23:04:17.982376Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}

Describe an IP filter

Confluent Cloud Console

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP groups view, appears.
Click IP filters. The IP filters view appears.
Click the name of the IP filter that you want to view. The IP filter details page appears, showing the IP filter name, IP filter ID, and IP groups.

To return to the list of IP filters, click “IP filtering” in the breadcrumb navigation at the top of the page.

Confluent CLI

Use the confluent iam ip-filter describe command (Confluent CLI reference) to describe a IP filter. For example, the following command shows the details about the ipf-abcef IP filter:

confluent iam ip-filter describe ipf-abcef

The following example shows the response to the request:

+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcef                                                               |
| Name             | India Offices                                                           |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-3rrky, ipg-wvppw                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+

Confluent Cloud APIs

To describe an IP filter, use the GET /iam/v2/ip-filters/{id} API endpoint (see Read an IP Filter).

For example, the following request describes the ipf-abcef IP filter:

curl --request GET \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-abcef' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'

The following example shows the response to the request:

{
  "api_version": "iam/v2",
  "filter_name": "India Offices",
  "id": "ipf-abcef",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:44:19.045344Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
    "updated_at": "2025-03-15T23:04:17.982376Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}

List IP filters

Confluent Cloud Console

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP groups view, appears.
Click IP filters. The IP filters view appears.

You can click an IP filter name to view the details.

Confluent CLI

Use the confluent iam ip-filter list command (Confluent CLI reference) to list the IP filters in your organization.

For example, the following command lists the IP filters.

confluent iam ip-filter list

The following example shows the response to the request:

     ID     |    Name       | Resource Group |      IP Groups       | Operation Groups |                             Resource Scope
------------+---------------+----------------+----------------------+------------------+--------------------------------------------------------------------------
  ipf-abcef | India Offices | multiple       | ipg-3rrky, ipg-wvppw | MANAGEMENT       | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01
  ipf-xyz12 | US Offices    | multiple       | ipg-4abcd            | MANAGEMENT       | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01

To list the IP filters for a specific environment, use the --environment flag. Add the --include-parent-scopes flag to also include the IP filters that are scoped to the organization that contains the environment.

confluent iam ip-filter list \
  --environment env-abc123 \
  --include-parent-scopes

Confluent Cloud APIs

To retrieve a list of the IP filters, use the GET /iam/v2/ip-filters API endpoint (see List of IP Filters).

For example, the following request lists the IP filters:

curl --request GET --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'

You can add the following query parameters to the request:

resource_scope: The CRN of the resource scope to list IP filters for.
include_parent_scopes: Set to true to also return the IP filters that are scoped to the parents of the specified resource scope.
page_size: The number of IP filters to return per page. The default is 25 and the maximum is 100.
page_token: The opaque token that identifies the next page of results. Use the value from metadata.next in the previous response.

The following example shows the response to the request:

{
  "api_version": "iam/v2",
  "data": [
    {
      "filter_name": "India Offices",
      "id": "ipf-abcef",
      "ip_groups": [
        {
          "id": "ipg-3rrky",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
        },
        {
          "id": "ipg-wvppw",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
        }
      ],
      "metadata": {
        "created_at": "2025-03-15T22:44:19.045344Z",
        "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
        "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
        "updated_at": "2025-03-15T23:04:17.982376Z"
      },
      "operation_groups": [
        "MANAGEMENT"
      ],
      "resource_group": "multiple",
      "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
    },
    {
      "filter_name": "US Offices",
      "id": "ipf-xyz12",
      "ip_groups": [
        {
          "id": "ipg-4abcd",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-4abcd",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-4abcd"
        }
      ],
      "metadata": {
        "created_at": "2025-03-15T22:44:19.045344Z",
        "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-xyz12",
        "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-xyz12",
        "updated_at": "2025-03-15T23:04:17.982376Z"
      },
      "operation_groups": [
        "MANAGEMENT"
      ],
      "resource_group": "multiple",
      "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
    }
  ],
  "kind": "IpFilterList",
  "metadata": {
    "first": "https://confluent.cloud/iam/v2/ip-filters",
    "next": ""
  }
}

Delete an IP filter

IP filters can be deleted to remove access to Confluent Cloud resources. You can also update an IP filter to remove an IP group from access.

Important

Deleting an IP filter removes the IP filter from your organization. If you delete an IP filter that is assigned to a network, the IP addresses in that network can no longer access the resources that the IP filter controls.

If all IP filters are removed, authorized users from any source IP address can access resources in your organization.

Confluent Cloud Console

Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

The IP filtering page, with the IP group view, appears.
Click IP filter. The IP filter view appears.
Click the IP filter name for the IP filter you want to delete. The IP filter details page appears.
Click Delete IP filter. The Delete IP filter dialog appears.
After confirming that you want to delete the specified IP filter, enter the IP filter name in the IP filter name field and click Confirm.

The IP filter is deleted and the Accounts & access page appears listing the remaining IP filters.

Confluent CLI

Use the confluent iam ip-filter delete command (Confluent CLI reference) to delete an IP filter. For example, the following command deletes the ipf-9876 IP filter:

confluent iam ip-filter delete ipf-9876

The command prompts you to confirm the deletion and then shows the following response:

Deleted IP filter "ipf-9876".

You can pass more than one IP filter ID to delete several IP filters in a single command.

Confluent Cloud APIs

To make a request to delete an IP filter, use the DELETE /iam/v2/ip-filters/{id} API endpoint (see Delete an IP Filter).

For example, the following request deletes the ipf-9876 IP filter:

curl --request DELETE \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-9876' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'

A successful request returns 204 No Content with an empty response body. You can verify that the IP filter was deleted by running the confluent iam ip-filter list command.

IP filter limits

Confluent Cloud enforces the following limits on IP filters:

Limit	Value
IP filters per organization	25
IP groups per IP filter	1 minimum, 25 maximum
IP filter name length	1 to 64 characters
IP filter name characters	Letters, numbers, the space character, and the following special characters: `[`, `]`, `\|`, `&`, `+`, `-`, `_`, `/`, `.`, and `,`
IP filter name uniqueness	Names must be unique within your organization
Resource scope	Organization or environment level only. The resource scope is set when you create the IP filter and can’t be changed afterward.
Operation groups	Required when `resource_group` is `multiple`. At least one operation group must be present; an empty list isn’t supported.

IP filter errors

The following table lists the errors that Confluent Cloud returns for IP filter operations and how to resolve them.

Operation	Error	Resolution
Create, Update	`filter_name cannot be empty`, `filter_name must be less than or equal to 64 characters`, or `filter_name can only contain letters, numbers, spaces, and certain special characters`	Provide a name that meets the constraints in IP filter limits.
Create, Update	`an IP filter with this filter_name already exists` (HTTP `409`)	Choose a name that isn’t already used by another IP filter in your organization.
Create, Update	`IP group does not exist`	Verify the IP group IDs with `confluent iam ip-group list`.
Create, Update	`your input contains multiple copies of the same IP Group: <ip-group-id>`	Remove the repeated IP group from the request.
Create, Update	`an IP Filter can have at most 25 IP Groups`	Reduce the number of IP groups, or consolidate CIDR blocks into fewer IP groups.
Create, Update	`Resource Group multiple indicates minimum one operation group.`	Include at least one operation group. See Operation groups.
Create, Update	`Resource Group is not supported`	Use either `management` or `multiple` for the resource group.
Create, Update	`Operation Group is not supported`	Use a supported operation group. See Operation groups.
Create, Update	`This IP Filter cannot have more than one IP group associated since the No Public Networks group has already been added here.`	The `ipg-none` IP group can’t be combined with any other IP group. See Block all public networks.
Create, Update	`Invalid resource or operation group for the IP Group: No Public Networks.`	The `ipg-none` IP group can’t be used with the resource management operation group.
Create, Update	`Management Operation Group does not support an environment level resource scope: '<crn>'`	Create the IP filter at the organization scope, or remove the `MANAGEMENT` operation group from the environment-scoped IP filter.
Create, Update	`Invalid resource scope '<crn>'`, `Must be either organization or environment level`, or `Cannot find resource matching ...`	Provide a valid organization or environment CRN for a resource that exists in your organization. See Resource scopes.
Create	`IP Filter quota exceeded` (HTTP `402`)	Delete an unused IP filter. Your organization can have at most 25 IP filters.
Create, Update, Delete	`this action would lock out the requester from IP address <ip-address>`	The change would block your own IP address from managing your organization. Retry from an IP address that the resulting IP filters permit, or include an IP group that covers your current IP address. For details, see Specify CIDR blocks for IP groups.
Update	`Resource Scope cannot be updated and is immutable.`	Delete the IP filter and create a new one with the resource scope that you want.
Update	`Operation groups exist for this filter and are not compatible with requested change` (HTTP `409`)	You can’t change an IP filter that uses operation groups to `resource_group: management`. Update the operation groups instead.
Update (Confluent CLI only)	`Cannot remove all IP groups from IP filter`	An IP filter must reference at least one IP group. Delete the IP filter instead, or add a replacement IP group in the same command.
Describe, Update, Delete	`IP filter not found` (HTTP `404`)	Verify the IP filter ID with `confluent iam ip-filter list`.
All	`user_unauthorized` (HTTP `403`)	You need the OrganizationAdmin role to manage organization-scoped IP filters, or the EnvironmentAdmin role for environment-scoped IP filters.
All	HTTP `429`	You exceeded the API rate limit. Wait for the number of seconds in the `Retry-After` response header and retry.

Manage IP Filters on Confluent Cloud

Prerequisites

Create an IP filter

Block all public networks

Update an IP filter

Describe an IP filter

List IP filters

Delete an IP filter

IP filter limits

IP filter errors

Related content