Networking Overview
Control client access and connect deployments through public or private networks
Networking configuration controls which clients can reach a deployment and how their traffic travels. Paid deployments need access rules before clients can connect. Free deployments start with a global rule.
VPC peering requires Performance or Enterprise. PrivateLink and Private Service Connect require Enterprise. The account plan must also enable private networking. Standard does not include these features. The deployment tier and account plan impose separate requirements.
Connectivity Options
| Feature | Scope | Availability | Purpose |
|---|---|---|---|
| Access Rules | All clouds | Every deployment | Allow specific IPs/CIDRs to reach deployment endpoints |
| VPC Peering | AWS, GCP | Performance and Enterprise (Managed only) | Private network path between your VPC and the deployment VPC |
| PrivateLink | AWS | Enterprise (Managed only) | Expose the deployment as a VPC endpoint service in your account |
| Private Service Connect | GCP | Enterprise (Managed only) | Expose the deployment as a PSC service attachment in your project |
Default Posture
Paid deployments start without client access rules. Create a rule before you connect. Warden's outbound management connection operates independently of these rules.
Free deployments include 0.0.0.0/0, a rule that opens all Iggy protocols to all IPv4 addresses. It also permits Stream UI in the browser to reach Warden's HTTP proxy. You can delete or replace this rule.
Required Permissions
Networking permissions apply within an environment:
| Permission | Grants |
|---|---|
deployment:access:read | View access rules |
deployment:access:manage | Create and delete access rules (implies read) |
deployment:network:read | View VPC peering connections, PrivateLink services, and PSC service attachments |
deployment:network:manage | Create and delete VPC peering, PrivateLink, and PSC (implies read) |
Plan Limits
VPC Peering requires Performance or Enterprise. PrivateLink and Private Service Connect require Enterprise. All require private networking access in the account plan. The plan also limits the number of rules and connections per deployment.
| Resource | Basic | Pro | Enterprise |
|---|---|---|---|
| Access rules per deployment | 3 | 10 | 20 |
| VPC peering connections per deployment | - | 3 | 5 |
| PrivateLink / PSC services per deployment | - | 1 | 5 |
| Private networking | - | Available | Available |
Network Info
Retrieve a Managed deployment's VPC ID and CIDR range before you configure peering or firewall rules. A VPC is a private cloud network. A CIDR range describes a group of IP addresses.
curl {supervisor_url}/deployments/{deployment_id}/network/info \
-H "ld-api-key: YOUR_API_KEY"{
"id": "vpc-0abc123def456789",
"cidr": "10.0.0.0/16"
}The request requires deployment:network:read.
This endpoint is unavailable for BYOC. Your cloud account already contains the VPC details.