Manage IP Filters on Confluent Cloud

Use IP filters to enhance the security of your Confluent Cloud resources by restricting access to trusted source IP addresses. IP filters use IP groups to streamline the organization of CIDR blocks into meaningful groups of source IP addresses that can access your Confluent Cloud resources. If an incoming IP address is associated with an allowed IP group, access is granted; otherwise, access is denied. By leveraging IP groups, IP filters can effectively enforce access control policies and help safeguard your Confluent Cloud resources from unauthorized access.

IP filters only impact requests from outside of Confluent Cloud and outside of your Confluent Cloud organization. IP filters do not impact requests from within your Confluent Cloud organization.

Resource scopes

Resource scopes allow you to apply different IP filtering rules at different levels within your Confluent Cloud organization. You can create IP filters that apply either to:

  • The entire organization (organization scope)
  • Specific environments (environment scope)

When IP filters exist at both organization and environment scope:

  • Environment-level filters can only add additional restrictions, not remove organization-level restrictions.
  • A request must satisfy both organization and environment-level filters to be allowed.
  • Organization-level filters act as a baseline policy for all environments unless further restricted.

For example, if an organization has IP filters that allow access only from the production datacenters, an environment-level filter cannot override this to allow access from development networks. However, the environment-level filter could further restrict access to only a specific production datacenter.

Note

When viewing IP filters for an environment, both environment-specific filters and organization-wide filters that affect that environment will be shown to provide a complete picture of access controls.

You can specify the resource scope during the creation of an IP filter through any of these interfaces:

  • Confluent Cloud Console: When you create an IP filter from the Accounts & access page, the IP filter is scoped to the entire organization. If you create the IP filter from the Environment > Network Management > For public networks page, the IP filter is scoped to that environment.
  • Confluent CLI: Use the --environment flag to specify the environment for the IP filter. If you do not specify the --environment flag, the IP filter applies to the entire organization.
  • Confluent Cloud APIs: Use the resource_scope field to specify the resource scope. If you do not specify this parameter, the IP filter applies to the entire organization.

The Confluent Resource Name (CRN) identifies the scope of an IP filter, which can be your entire organization or a specific environment.

  • An organization-scoped IP filter might have a resource_scope value of:

    crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a
    Copy

  • An environment-scoped IP filter might have a resource_scope value of:

    crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-abc123
    Copy

When you create an IP filter, you can specify a resource_scope value to control the scope of the IP filter. The following rules apply:

  • When resource_scope is empty (default), the IP filter applies to your entire organization.
  • Environment-level filters can only add additional restrictions, not remove organization-level restrictions. A request must satisfy both organization and environment-level filters to be allowed.
  • IP filters at the organization level act as the baseline policy for all environments.
  • Multiple IP filters at the same scope level (organization or environment) are additive, meaning they expand the set of allowed IP addresses. For example, if one filter allows access from IP group A and another filter at the same scope allows access from IP group B, requests from either IP group A or B are permitted.
  • When a resource scope is specified, it is immutable and cannot be changed after the IP filter is created.

Operation groups

Operation groups are used to specify the operations that the IP filter applies to. Each operation group is a collection of operations that can be controlled collectively by an IP filter. For each IP filter, you must select one or more operation groups to control which operations the IP filter applies to.

You can specify operation groups when creating an IP filter through any of these interfaces:

  • Confluent Cloud Console: Select operation groups in the Operation groups section when adding a new IP filter.
  • Confluent CLI: Use the --operations flag to specify operation groups when creating an IP filter.
  • Confluent Cloud APIs: Include operation groups using the operation_groups field in your API request. To be able to specify operation groups, you must include the resource_group field in your API request, with a value of multiple. This indicates that operation groups are defined using the operation_groups field.

Operation group names and identifiers

The following tables list the names and identifiers for the operation groups that are currently available and reserved for future use.

Currently available operation groups
Category Operation group Identifier
Management Resource management management
Management Schema management schema
Data Flink flink
Reserved for future use (Not configurable)
Category Operation group Identifier
Management Catalog management catalog
Management Kafka Management kafka_management
Monitoring Logging logs
Monitoring Metrics metrics
Data Kafka produce and consume kafka_data
Data ksqlDB ksql

Operation group API operations

The following sections list the API operations for each operation group.

Resource management

The Resource management operation group covers all management operations requested from the resource management APIs available through api.confluent.cloud. For a list of supported APIs, click the following link to expand and display the list, or click the link again to collapse the list.

Resource management APIs (api.confluent.cloud) - Supported by IP Filtering
  • ORG API (V2)
    • Organizations (org/v2)
    • Environments (org/v2)
  • IDENTITY ACCESS MANAGEMENT (v2)
    • API Key (iam/v2)
    • Users (iam/v2)
    • Service Accounts (iam/v2)
    • Invitations (iam/v2)
    • IP Groups (iam/v2)
    • IP Filters (iam/v2)
    • Role Bindings (iam/v2)
    • Identity Providers (iam/v2)
    • Jwks (iam/v2)
    • Identity Pools (iam/v2)
    • Group Mappings (iam/v2/sso)
  • BRING YOUR OWN KEY (BYOK) MANAGEMENT (V1)
    • Keys (byok/v1)
  • CLUSTER MGMT FOR KAFKA (V2)
    • Clusters (cmk/v2)
  • CLUSTER MGMT FOR SCHEMA REGISTRY (V2)
    • Regions (srcm/v2)
    • Clusters (srcm/v2)
  • COMPUTE POOL MGMT FOR FLINK (V2)
    • Compute Pools (fcpm/v2)
    • Regions (fcpm/v2)
  • CLUSTER MGMT FOR KSQLDB (V2)
    • Clusters (ksqldbcm/v2)
  • CONNECT API (V1)
    • Connectors (connect/v1)
    • Lifecycle (connect/v1)
    • Status (connect/v1)
    • Managed Connector Plugins (connect/v1)
    • Presigned Urls (connect/v1)
  • STREAM SHARING API (V1)
    • Provider Shared Resources (cdx/v1)
    • Provider Shares (cdx/v1)
    • Consumer Shared Resources (cdx/v1)
    • Consumer Shares (cdx/v1)
    • Shared Tokens (cdx/v1)
    • Opt Ins (cdx/v1)
  • NETWORKING (V1)
    • Networks (networking/v1)
    • Peerings (network/v1)
    • Transit Gateway Attachments (networking/v1)
    • Private Link Accesses (networking/v1)
    • Network Link Services (networking/v1)
    • Network Link Endpoints (networking/v1)
    • Network Link Service Associations (networking/v1)
    • IP Addresses (networking/v1)
    • Private Link Attachments (networking/v1)
    • Private Link Attachment Connections (networking/v1)
  • NOTIFICATIONS API (V1)
    • Subscriptions (notifications/v1)
    • Integrations (notifications/v1)
    • Notification Types (notifications/v1)
  • SECURITY TOKEN SERVICE (V1)
    • OAuth Tokens (sts/v1)
  • SERVICE QUOTA API (V1)
    • Applied Quotas (service-quota/v1)
    • Scopes (service-quota/v1)
  • KAFKA QUOTA (V1)
    • Client Quotas (kafka-quotas/v1)
  • BILLING API (V1)
    • Costs (billing/v1)
  • PARTNER API (V2)
    • Entitlements (partner/v2)
    • Organizations (partner/v2)
    • Signup (partner/v2)

Schema management

The Schema management operation group covers all operations related to schema management.

The following SCHEMA REGISTRY API (v1) operations are supported:

  • Compatibility (v1)
  • Config (v1)
  • Contexts (v1)
  • Exporters (v1)
  • Modes (v1)
  • Schemas (v1)
  • Subjects (v1)

Use the predefined No Public Networks group

You can use the predefined No Public Networks group to create an IP filter that prevents access from public networks and allows access only from private network connections. You can select this option in the following interfaces:

  • Confluent Cloud Console: Select the No Public Networks group in the drop-down list in the IP groups field of the Apply IP groups section.
  • Confluent CLI: Use the --no-public-networks flag (without the --ip-groups flag) to specify the No Public Networks group. When you add this flag, the IP group ID is automatically set to ipg-none.
  • Confluent Cloud APIs: Include the No Public Networks group in the ip_groups field of the request body by setting the id to ipg-none.

When you create an IP filter with the No Public Networks group, the following constraints apply:

  • For each operation group, an IP filter allowing “No Public Networks” cannot be combined with any other IP filters.
  • The No Public Networks group cannot be combined with other IP groups when defining an IP filter.
  • The No Public Networks group cannot be applied to operation groups without private networking support (currently “management”), as it would block all access..

When you attempt to use the No Public Networks group in an IP filter, creating or updating the IP filter will fail if you:

  • Include other IP groups in the same IP filter as the No Public Networks group.
  • Have existing IP filters with overlapping operation groups that reference IP groups other than the No Public Networks group.

Create an IP filter

Before you can define an IP filter that allows specific access, you must define at least one IP group. An IP group defines a set of IP addresses that can access Confluent Cloud resources. To create an IP group, see Create an IP group.

You can add an IP filter to control access either organization-wide or to a specific environment in your Confluent Cloud organization. In the CLI and API, IP filters are applied organization-wide. If you assign an environment resource scope to an IP filter, it adds restrictions specific to that environment while still enforcing any organization-level filters. For details, see Resource scopes.

You must also specify the operation groups that your IP filter applies to. Operation groups are collections of operations or API calls that can be controlled collectively by an IP filter. For details, see Operation groups.

Access is granted only to client IP addresses included within specified IP groups. The operation groups and resource scope determine which operations the IP filter affects. Using the combination of IP groups, operation groups, and resource scope, you can use IP filters to restrict access to your Confluent Cloud resources.

Important

The first IP filter you create that includes the operation group “management” must include an IP group that covers the IP address of your client. You are prevented from creating an IP filter that would block access your own access to managing IP filters. For more details and a tip on how to specify a CIDR block for your current IP address, see Specify CIDR blocks for IP groups.

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters . The IP filter view appears.

  3. Click Add IP filter. The Add IP filter page appears.

  4. In the IP filters field, enter a name for the IP filter.

  5. In the IP groups field of the Apply IP groups section, select the IP groups that are allowed to access this resource. You must include at least one IP group.

    In the drop-down list, you can select from the IP groups that you have already created or the predefined No Public Networks group.

    The predefined No Public Networks group excludes all public IP addresses, allowing access only from private network connections.

    • To allow no public network access, use this group with only one IP filter per operation group.
    • You cannot use the No Public Networks group with any other IP groups.

  6. In the Operation groups section, select the operation groups that are allowed to access this resource. Under the Management operation group, select from the currently available operation groups that are allowed to access this resource.

    The operation groups listed include:

    • Management
      • Resource management - Includes the management of resources in your Confluent Cloud organization, but does not include operations on those resources, such as producing and consuming messages.
      • Schema management
    • Monitoring
      • Logs (Not configurable)
      • Metrics (Not configurable)
    • Data
      • Flink
      • Kafka (Not configurable)
      • ksqlDB (Not configurable)

  7. Click Save and enable.

The IP filter is created and the IP filters view appears, listing the IP filter name, operation groups, IP filter ID, and IP groups.

To prevent you from blocking access to your Confluent Cloud resources, you cannot create an IP filter covering the resource management operation group if an existing IP filter does not include your client IP address. If you try to create an IP filter that does not include your client IP address, an error message appears stating “This IP filter would block access from your current IP address (<your-ip-address>) and is not allowed.”

Update an IP filter

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters . The IP filter view appears.

#. In the table of IP filters, click the name of the IP filter that you want to update. The IP filter details page appears.

  1. Click Edit IP filter. The IP filter fields appear.
  2. Edit the values of your IP filter name, IP groups, and Operation groups, as needed, and click Save.

The IP filter is updated and the updated IP filters list reappears.

Describe an IP filter

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters. The IP filters view appears.

  3. Click the name of the IP filter that you want to view. The IP filter details page appears, showing the IP filter name, IP filter ID, and IP groups.

To return to the list of IP filters, click “IP filtering” in the breadcrumb navigation at the top of the page.

List IP filters

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP groups view, appears.

  2. Click IP filters. The IP filters view appears.

You can click an IP filter name to view the details.

Delete a IP filter

IP filters can be deleted to remove access to Confluent Cloud resources. You can also update an IP filter to remove an IP group from access.

Important

Deleting a IP filter removes the IP filter from your organization. If you delete a IP filter that is assigned to a network, the IP addresses in that network can no longer access to the resources that the IP filter controls.

If all IP filters are removed, authorized users from any source IP address can access resources in your organization.

  1. Go to the IP filtering tab on the Accounts & access page at https://confluent.cloud/settings/org/ip-filtering.

    The IP filtering page, with the IP group view, appears.

  2. Click IP filter. The IP filter view appears.

  3. Click the IP filter name for the IP filter you want to delete. The IP filter details page appears.

  4. Click Delete IP filter. The Delete IP filter dialog appears.

  5. After confirming that you want to delete the specified IP filter, enter the IP filter name in the IP filter name field and click Confirm.

The IP filter is deleted and the Accounts & access page appears listing the remaining IP filters.

Related content