cloud-network-security

Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.

532stars41forksUpdated 7/16/2026

#elastic-cloud #aws-privatelink #access-control #cloud-security #serverless #networking

Security Assessment

Medium Risk(50/100)

Detected risks:

Secret Exposure([SKILL.md] API_KEY=)

Sensitive File Access([SKILL.md] .env)

Security Score50/100

About cloud-network-security

cloud-network-security manages network security policies (traffic filters) for Elastic Cloud Serverless projects. It lets users create, update, and delete IP filters to allowlist specific IPs or CIDR blocks, and VPC filters (AWS PrivateLink) to restrict traffic to specific VPC endpoint IDs. It solves the problem of restricting network access and configuring private connectivity for Serverless projects, using "network security" as the umbrella term aligned with the Elastic Cloud UI while the underlying API uses "traffic filters" (type ip and type vpce).

Operations are driven through scripts/cloud_network_security.py, for example running the list-filters command (optionally with --region us-east-1) to verify the API key and check existing state. The skill documents a decomposition workflow: identify the filter type, region, rules, scope, and target projects; check existing state to avoid duplicate filters; create the filter with the appropriate command; associate it with projects via the project PATCH endpoint (PATCH /api/v1/serverless/projects/{type}/{id} with a traffic_filters body listing the complete set of filter IDs, since any filter omitted is disassociated); and verify by listing filters or getting the project again. Filters are region-scoped, so the user must specify the target region when creating them, and a single filter with the right rules can serve many projects. Association itself delegates to the cloud-manage-project skill, while cloud-create-project handles project creation and cloud-access-management handles identity and access.

The skill requires Python 3.8+ and network access to the Elastic Cloud API (api.elastic-cloud.com). It reads EC_API_KEY (required, normally set by the cloud-setup skill) and the optional EC_BASE_URL (defaulting to https://api.elastic-cloud.com); if EC_API_KEY is missing it directs the agent to run cloud-setup first and never prompts the user for a key in chat. A manual fallback lets users configure a .env file (auto-loaded by cloud/* scripts) or export variables directly. Operation-level permissions apply: any organization member can list filters or get metadata, while creating, updating, or deleting filters requires organization owner (organization-admin) and associating filters requires organization owner or project Admin. The skill does not pre-check roles; it attempts the operation and, on an authorization error such as 403 Forbidden, stops and asks the user to verify the API key permissions.

FAQ

What kinds of filters can this skill manage?

Two types: IP filters (type ip) to allowlist specific IPs or CIDR blocks, and VPC filters (type vpce, AWS PrivateLink) to restrict traffic to specific VPC endpoint IDs. It can list, inspect, create, update, and delete these region-scoped network security policies.

What are the prerequisites and environment variables?

It requires Python 3.8+ and network access to api.elastic-cloud.com. EC_API_KEY is required and is normally set by the cloud-setup skill; EC_BASE_URL is optional and defaults to https://api.elastic-cloud.com. If EC_API_KEY is missing, the agent should invoke cloud-setup first rather than prompting the user for a key.

What permissions are needed for each operation?

Listing filters or getting metadata is available to any organization member; creating, updating, or deleting filters requires organization owner (organization-admin); and associating filters with projects requires organization owner or project Admin. The skill does not pre-check roles and instead lets the API enforce authorization, stopping on errors like 403 Forbidden.

How are filters associated with projects?

Association is handled by the project PATCH endpoint, PATCH /api/v1/serverless/projects/{type}/{id}, with a body of { "traffic_filters": [{ "id": "..." }] }. You must provide the complete list of filter IDs, because any filter not included is disassociated. This step delegates to the cloud-manage-project skill.

How do I configure the API key without cloud-setup?

As a manual fallback, create a .env file in the project root with EC_API_KEY (and optionally EC_BASE_URL), which all cloud/* scripts auto-load from the working directory, or export the variables directly in the terminal. The skill never asks the user to paste API keys in chat; keys can be generated at Elastic Cloud API keys.