From elastic-agent-skills
Manages Elastic Cloud Serverless network security: create, update, delete IP filters and AWS PrivateLink VPC filters. Use for restricting network access or private connectivity.
npx claudepluginhub elastic/agent-skills --plugin elastic-securityThis skill uses the workspace's default tool permissions.
Manage network security policies for Elastic Cloud Serverless projects: IP filters to allowlist specific IPs or CIDRs,
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
Manage network security policies for Elastic Cloud Serverless projects: IP filters to allowlist specific IPs or CIDRs, and VPC filters (AWS PrivateLink) to restrict traffic to specific VPC endpoints.
Prerequisite: This skill assumes the cloud-setup skill has already run —
EC_API_KEYis set in the environment and the organization context is established. IfEC_API_KEYis missing, instruct the agent to invoke cloud-setup first. Do NOT prompt the user for an API key directly.
For project creation and day-2 operations (including associating filters with projects), see cloud-create-project and cloud-manage-project. For identity and access management (users, roles, API keys), see cloud-access-management.
For detailed API endpoints and request schemas, see references/api-reference.md.
This skill uses network security as the umbrella term, aligned with the Elastic Cloud UI direction. The underlying
API uses traffic filters — you will see traffic-filters in endpoint paths and traffic_filters in JSON fields.
When a user or agent says "traffic filter," they mean the same thing as "network security policy." The two filter types
are IP filters (type ip) and VPC filters (type vpce).
| Item | Description |
|---|---|
| EC_API_KEY | Cloud API key (set by cloud-setup). Required for all operations. |
| Region | Filters are region-scoped. The user must specify the target region when creating filters. |
| Project IDs | Required only when associating filters with projects (handled by cloud-manage-project). |
Run python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters to verify that EC_API_KEY
is valid before proceeding with any operation.
The following permissions are required for common network security operations in Elastic Cloud Serverless.
| Operation | Required permission |
|---|---|
| List filters / get metadata | Any organization member |
| Create / update / delete filters | Organization owner (organization-admin) |
| Associate filters with projects | Organization owner or project Admin |
This skill does not perform a separate role pre-check. Attempt the requested operation and let the API enforce
authorization. If the API returns an authorization error (for example, 403 Forbidden), stop and ask the user to verify
the provided API key permissions.
If this skill is installed standalone and cloud-setup is not available, instruct the user to configure Cloud
environment variables manually before running commands. Never ask the user to paste API keys in chat.
| Variable | Required | Description |
|---|---|---|
EC_API_KEY | Yes | Elastic Cloud API key (see permissions table above for required roles by operation). |
EC_BASE_URL | No | Cloud API base URL (default: https://api.elastic-cloud.com). |
Note: If
EC_API_KEYis missing, or the user does not have a Cloud API key yet, direct the user to generate one at Elastic Cloud API keys, then configure it locally using the steps below.
Preferred method (agent-friendly): create a .env file in the project root:
EC_API_KEY=your-api-key
EC_BASE_URL=https://api.elastic-cloud.com
All cloud/* scripts auto-load .env from the working directory.
Alternative: export directly in the terminal:
export EC_API_KEY="<your-cloud-api-key>"
export EC_BASE_URL="https://api.elastic-cloud.com"
Terminal exports may not be visible to sandboxed agents running in separate shell sessions, so prefer .env when using
an agent.
When the user describes a network security need in natural language (for example, "restrict my search project to our office IP"), break the request into discrete tasks before executing.
| Component | Question to answer |
|---|---|
| Filter type | IP filter (public IPs/CIDRs) or VPC filter (AWS PrivateLink endpoint)? |
| Region | Which AWS region are the target projects in? |
| Rules | What source IPs, CIDRs, or VPC endpoint IDs should be allowed? |
| Scope | Apply to all new projects by default, or specific projects only? |
| Projects | Which existing projects should this filter be associated with? |
Before creating a new filter, check what already exists:
python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters --region us-east-1
Filter hygiene: If an existing filter already covers the same source rules for the same purpose, reuse it instead of creating a duplicate. Filters are region-scoped and can be associated with multiple projects, so a single filter with the right rules serves many projects. Two filters with identical source rules are fine when they serve different purposes (for example, different teams managing their own policies), but creating a second filter for the same purpose is unnecessary.
Run the appropriate command from skills/cloud/network-security/scripts/cloud_network_security.py.
Filter association is managed using the project PATCH endpoint. Use cloud-manage-project to associate or disassociate filters:
PATCH /api/v1/serverless/projects/{type}/{id}
Body: { "traffic_filters": [{ "id": "filter-id-1" }, { "id": "filter-id-2" }] }
When updating associations, provide the complete list of filter IDs. Any filter not included in the list is disassociated from the project.
After execution, list filters again or GET the project to confirm the change took effect.
| Aspect | IP Filter (ip) | VPC Filter (vpce) |
|---|---|---|
| Purpose | Allowlist public IP addresses or CIDR blocks | Restrict traffic to specific AWS VPC endpoint IDs |
| Use case | Office IPs, CI/CD runners, partner access | Private connectivity without public internet exposure |
| Source format | IP address or CIDR (for example, 203.0.113.0/24) | AWS VPC endpoint ID (for example, vpce-0abc123def456) |
| Network path | Public internet | AWS PrivateLink (private, never leaves AWS network) |
| Prerequisite | None | VPC endpoint and DNS record created in AWS console first |
Key concept: Private connectivity in AWS is accepted by default in Elastic Cloud. Creating a VPC filter is only needed to restrict traffic to specific VPC endpoint IDs. If you only need private connectivity (without filtering), create the VPC endpoint and DNS record in AWS — no filter is needed on the Elastic Cloud side.
Prompt: "Only allow traffic from our office network 203.0.113.0/24 to projects in us-east-1."
python3 skills/cloud/network-security/scripts/cloud_network_security.py create-filter \
--name "Office IP allowlist" \
--type ip \
--region us-east-1 \
--rules '[{"source": "203.0.113.0/24", "description": "Office network"}]'
Then associate the filter with specific projects using cloud-manage-project.
Prompt: "Lock down my observability project to only accept traffic from our VPC endpoint."
python3 skills/cloud/network-security/scripts/cloud_network_security.py create-filter \
--name "Production VPC" \
--type vpce \
--region us-east-1 \
--rules '[{"source": "vpce-0abc123def456", "description": "Production VPC endpoint"}]'
Prompt: "Show me all network security policies in eu-west-1."
python3 skills/cloud/network-security/scripts/cloud_network_security.py list-filters --region eu-west-1
Prompt: "Add the VPN IP 198.51.100.5 to our existing office filter."
python3 skills/cloud/network-security/scripts/cloud_network_security.py get-filter --filter-id tf-12345
# Review current rules, then update with the complete rule set:
python3 skills/cloud/network-security/scripts/cloud_network_security.py update-filter \
--filter-id tf-12345 \
--body '{"rules": [{"source": "203.0.113.0/24", "description": "Office network"}, {"source": "198.51.100.5", "description": "VPN"}]}'
Prompt: "What PrivateLink service name do I need for us-east-1?"
python3 skills/cloud/network-security/scripts/cloud_network_security.py get-metadata --region us-east-1
Prompt: "Remove the old staging IP filter."
python3 skills/cloud/network-security/scripts/cloud_network_security.py delete-filter --filter-id tf-67890 --dry-run
# Review what would be deleted, then confirm:
python3 skills/cloud/network-security/scripts/cloud_network_security.py delete-filter --filter-id tf-67890
EC_API_KEY is not set, do not prompt the user — instruct the agent to invoke cloud-setup first.us-east-1 can only be associated with projects in that region.list-filters and check whether an existing filter for the same purpose
already has the required source rules. Filters can be associated with multiple projects, so one filter with the
right rules is better than duplicates.traffic_filters list), then delete.include_by_default automatically associates the filter with all new projects in the region. Use with caution — it
affects every future project.