| name | configuring-ip-allowlists |
| description | Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0/0, or setting up allowlists for a new cluster. |
| compatibility | Requires ccloud CLI with Cluster Admin or Cluster Operator role. |
| metadata | {"author":"cockroachdb","version":"1.0"} |
Configuring IP Allowlists
Configures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as 0.0.0.0/0) and replaces them with specific, narrow ranges.
When to Use This Skill
- Removing
0.0.0.0/0 (open to all) from the IP allowlist
- Restricting network access after initial cluster setup
- Adding office, VPN, or CI/CD CIDR ranges to the allowlist
- Reviewing and tightening existing allowlist entries
- Responding to a security audit finding about overly broad network access
Prerequisites
- ccloud CLI installed and authenticated (
ccloud auth login)
- Cloud Console role: Cluster Admin or Cluster Operator
- Known CIDR ranges: Office IPs, VPN egress IPs, CI/CD runner IPs, or other authorized sources
- Available from
