Cloud Network Security

Cloud Network Security

Manage network security policies for Elastic Cloud Serverless projects: IP filters to allowlist specific IPs or CIDRs, and VPC filters (AWS PrivateLink) to restrict traffic to specific VPC endpoints.

Prerequisite: This skill assumes the cloud-setup skill has already run — EC_API_KEY is set in the

environment and the organization context is established. If EC_API_KEY is missing, instruct the agent to invoke

cloud-setup first. Do NOT prompt the user for an API key directly.

For project creation and day-2 operations (including associating filters with projects), see cloud-create-project and cloud-manage-project. For identity and access management (users, roles, API keys), see cloud-access-management.

For detailed API endpoints and request schemas, see references/api-reference.md.

Terminology

This skill uses network security as the umbrella term, aligned with the Elastic Cloud UI direction. The underlying API uses traffic filters — you will see traffic-filters in endpoint paths and traffic_filters in JSON fields. When a user or agent says "traffic filter," they mean the same thing as "network security policy." The two filter types are IP filters (type ip) and VPC filters (type vpce).

Jobs to Be Done

• Create an IP filter to restrict ingress to specific IPs or CIDR blocks
• Create a VPC filter (AWS PrivateLink) to restrict traffic to specific VPC endpoint IDs
• List, inspect, update, and delete network security policies
• Look up PrivateLink region metadata (service names, domain names, availability zones)
• Associate or disassociate filters with Serverless projects (delegates to cloud-manage-project)
• Audit the current network security posture for an organization

Prerequisites and permissions

Run python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters to verify that EC_API_KEY is valid before proceeding with any operation.

Operation-level permissions

The following permissions are required for common network security operations in Elastic Cloud Serverless.

This skill does not perform a separate role pre-check. Attempt the requested operation and let the API enforce authorization. If the API returns an authorization error (for example, 403 Forbidden), stop and ask the user to verify the provided API key permissions.

Manual setup fallback (when cloud-setup is unavailable)

If this skill is installed standalone and cloud-setup is not available, instruct the user to configure Cloud environment variables manually before running commands. Never ask the user to paste API keys in chat.

Note: If EC_API_KEY is missing, or the user does not have a Cloud API key yet, direct the user to generate one

at Elastic Cloud API keys, then configure it locally using the steps below.

Preferred method (agent-friendly): create a .env file in the project root:

EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.com

All cloud/* scripts auto-load .env from the working directory.

Alternative: export directly in the terminal:

export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"

Terminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer .env when using an agent.

Decomposing Network Security Requests

When the user describes a network security need in natural language (for example, "restrict my search project to our office IP"), break the request into discrete tasks before executing.

Step 1 — Identify the components

Step 2 — Check existing state

Before creating a new filter, check what already exists:

python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters --region us-east-1

Filter hygiene: If an existing filter already covers the same source rules for the same purpose, reuse it instead of creating a duplicate. Filters are region-scoped and can be associated with multiple projects, so a single filter with the right rules serves many projects. Two filters with identical source rules are fine when they serve different purposes (for example, different teams managing their own policies), but creating a second filter for the same purpose is unnecessary.

Step 3 — Create the filter

Run the appropriate command from skills/cloud/network-security/scripts/cloud_network_security.py.

Step 4 — Associate with projects

Filter association is managed using the project PATCH endpoint. Use cloud-manage-project to associate or disassociate filters:

PATCH /api/v1/serverless/projects/{type}/{id}
Body: { "traffic_filters": [{ "id": "filter-id-1" }, { "id": "filter-id-2" }] }

When updating associations, provide the complete list of filter IDs. Any filter not included in the list is disassociated from the project.

Step 5 — Verify

After execution, list filters again or GET the project to confirm the change took effect.

IP Filters versus VPC Filters

Key concept: Private connectivity in AWS is accepted by default in Elastic Cloud. Creating a VPC filter is only

needed to restrict traffic to specific VPC endpoint IDs. If you only need private connectivity (without

filtering), create the VPC endpoint and DNS record in AWS — no filter is needed on the Elastic Cloud side.

Examples

Allowlist an office IP range

Prompt: "Only allow traffic from our office network 203.0.113.0/24 to projects in us-east-1."

python3 skills/cloud/network-security/scripts/cloud_network_security.py create-filter \
  --name "Office IP allowlist" \
  --type ip \
  --region us-east-1 \
  --rules '[{"source": "203.0.113.0/24", "description": "Office network"}]'

Then associate the filter with specific projects using cloud-manage-project.

Restrict traffic to a VPC endpoint

Prompt: "Lock down my observability project to only accept traffic from our VPC endpoint."

python3 skills/cloud/network-security/scripts/cloud_network_security.py create-filter \
  --name "Production VPC" \
  --type vpce \
  --region us-east-1 \
  --rules '[{"source": "vpce-0abc123def456", "description": "Production VPC endpoint"}]'

List all filters in a region

Prompt: "Show me all network security policies in eu-west-1."

python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters --region eu-west-1

Update a filter to add a new IP

Prompt: "Add the VPN IP 198.51.100.5 to our existing office filter."

python3 skills/cloud/network-security/scripts/cloud_network_security.py get-filter --filter-id tf-12345
# Review current rules, then update with the complete rule set:
python3 skills/cloud/network-security/scripts/cloud_network_security.py update-filter \
  --filter-id tf-12345 \
  --body '{"rules": [{"source": "203.0.113.0/24", "description": "Office network"}, {"source": "198.51.100.5", "description": "VPN"}]}'

Look up PrivateLink metadata for a region

Prompt: "What PrivateLink service name do I need for us-east-1?"

python3 skills/cloud/network-security/scripts/cloud_network_security.py get-metadata --region us-east-1

Delete an unused filter

Prompt: "Remove the old staging IP filter."

python3 skills/cloud/network-security/scripts/cloud_network_security.py delete-filter --filter-id tf-67890 --dry-run
# Review what would be deleted, then confirm:
python3 skills/cloud/network-security/scripts/cloud_network_security.py delete-filter --filter-id tf-67890

Guidelines

• If EC_API_KEY is not set, do not prompt the user — instruct the agent to invoke cloud-setup first.
• Always confirm destructive actions (delete filter) with the user before executing.
• Filters are region-scoped: a filter created in us-east-1 can only be associated with projects in that region.
• Filter hygiene — reuse, scope, and clean up:
• Before creating a filter, always run list-filters and check whether an existing filter for the same purpose

already has the required source rules. Filters can be associated with multiple projects, so one filter with the right rules is better than duplicates.

• Duplicate filters means filters for the same purpose with identical source rules — not merely overlapping IPs. Two

filters covering different project groups with the same CIDR are legitimate.

• Review unused filters periodically. If a filter is no longer associated with any project, prompt the user to delete

it to reduce clutter.

• Updating rules replaces the entire rule set. When adding a rule using PATCH, include all existing rules plus the

new one. Omitting an existing rule removes it.

• Deleting a filter fails if it is still associated with a project. Disassociate first using

cloud-manage-project (PATCH the project with the filter removed from the traffic_filters list), then delete.

• include_by_default automatically associates the filter with all new projects in the region. Use with caution — it

affects every future project.

• For project association and disassociation, delegate to the cloud-manage-project skill. This skill manages filter

definitions only.

• For identity and access management (users, roles, API keys), see cloud-access-management.
• For Elasticsearch-level security (native users, role mappings, DLS/FLS), see elasticsearch-authz.

Cloud Network Security — API Reference

All Serverless traffic filter API calls use base URL https://api.elastic-cloud.com and require the header Authorization: ApiKey $EC_API_KEY.

Note: The API uses the term "traffic filters" in endpoint paths and JSON fields. The parent skill uses "network

security" as the umbrella term. Both refer to the same concept.

Table of Contents

• Traffic Filters
• List traffic filters
• Create a traffic filter
• Get a traffic filter
• Update a traffic filter
• Delete a traffic filter
• PrivateLink Metadata
• List PrivateLink region metadata
• Schemas
• TrafficFilterRequest
• PatchTrafficFilterRequest
• TrafficFilterRule
• TrafficFilterInfo
• Project Association

---

Traffic Filters

Official API docs:

Serverless traffic filter endpoints

List traffic filters

GET /api/v1/serverless/traffic-filters

Returns all traffic filters for the authenticated organization.

Query parameters:

Response (200):

{
  "items": [
    {
      "id": "tf-12345",
      "name": "Office IP allowlist",
      "description": "Allow office network",
      "type": "ip",
      "include_by_default": false,
      "region": "us-east-1",
      "rules": [{ "source": "203.0.113.0/24", "description": "Office network" }]
    }
  ]
}

Create a traffic filter

POST /api/v1/serverless/traffic-filters

Creates a traffic filter consisting of a set of rules.

Request body: TrafficFilterRequest

Response (201): TrafficFilterInfo — includes the generated id.

Example — IP filter:

{
  "name": "Office IPs",
  "description": "Corporate office allowlist",
  "type": "ip",
  "region": "us-east-1",
  "include_by_default": false,
  "rules": [
    { "source": "203.0.113.0/24", "description": "Office network" },
    { "source": "198.51.100.5", "description": "VPN gateway" }
  ]
}

Example — VPC filter (AWS PrivateLink):

{
  "name": "Production VPC",
  "description": "Restrict to production VPC endpoint",
  "type": "vpce",
  "region": "us-east-1",
  "include_by_default": false,
  "rules": [{ "source": "vpce-0abc123def456", "description": "Production VPC endpoint" }]
}

Get a traffic filter

GET /api/v1/serverless/traffic-filters/{id}

Retrieves a single traffic filter by ID.

Path parameters:

Response (200): TrafficFilterInfo

Update a traffic filter

PATCH /api/v1/serverless/traffic-filters/{id}

Partially updates a traffic filter. Only include the fields to change.

Path parameters:

Request body: PatchTrafficFilterRequest

Response (200): TrafficFilterInfo

Important: When updating rules, provide the complete rule set. Any rules not included in the update are

removed. To add a rule, include all existing rules plus the new one.

Delete a traffic filter

DELETE /api/v1/serverless/traffic-filters/{id}

Deletes a traffic filter by ID. Fails with 400 if the filter is still associated with a project. Disassociate the filter from all projects first using the project PATCH endpoint.

Path parameters:

Response (200): Empty response on success.

Error (400): Returns an error if the filter is associated with a project:

{
  "errors": [{ "message": "traffic filter is associated with <project-id>, remove the association first" }]
}

---

PrivateLink Metadata

Official API docs:

Serverless traffic filter endpoints

List PrivateLink region metadata

GET /api/v1/serverless/traffic-filters/metadata

Returns region-specific PrivateLink connectivity metadata (service names, domain names, availability zones). Use this to look up the VPC service name needed when creating a VPC endpoint in the AWS console.

Query parameters:

Response (200):

{
  "regions": [
    {
      "region": "us-east-1",
      "service_name": "com.amazonaws.vpce.us-east-1.vpce-svc-...",
      "domain_name": "private.us-east-1.aws.elastic.cloud",
      "availability_zones": ["use1-az2", "use1-az4", "use1-az6"]
    }
  ]
}

---

Schemas

TrafficFilterRequest

Used when creating a traffic filter (POST).

PatchTrafficFilterRequest

Used when updating a traffic filter (PATCH). All fields are optional; only included fields are updated.

type and region cannot be changed after creation.

TrafficFilterRule

A single rule within a traffic filter.

TrafficFilterInfo

Returned by all read and write operations. Extends TrafficFilterRequest with an id field.

---

Project Association

Official API docs:

Patch Elasticsearch project

·

Patch Observability project

·

Patch Security project

Traffic filters are associated with Serverless projects using the project PATCH endpoint, not through the traffic filter API. This is handled by the cloud-manage-project skill.

Associate a filter with a project

PATCH /api/v1/serverless/projects/{type}/{id}

Include the traffic_filters field with the complete list of filter IDs to associate:

{
  "traffic_filters": [{ "id": "tf-12345" }, { "id": "tf-67890" }]
}

Any filter ID not included in the list is disassociated from the project. To remove all filters, send an empty array.

List projects associated with a filter

GET /api/v1/serverless/projects/{type}?traffic_filter={filter-id}

Returns projects that have the specified filter associated.

Include filters at project creation

POST /api/v1/serverless/projects/{type}

Include traffic_filters in the creation request body to associate filters from the start:

{
  "name": "my-project",
  "region_id": "us-east-1",
  "traffic_filters": [{ "id": "tf-12345" }]
}

For full project creation and management schemas, see the cloud-create-project and cloud-manage-project skills.