Description

Ensure each Render Key Value instance either has external connections disabled or allows them only from approved IP ranges, and never allows 0.0.0.0/0. Services in the same region can still connect using the internal URL.

Rationale

Key Value instances often store sessions, tokens, and job data. Allowing external access from any IP lets anyone on the internet try to connect, and a leaked password would give full access. Keeping external access off, or limited to known IPs, protects this data.

Impact

  • Only approved IP ranges can connect from outside Render

  • Reduces exposure of cached and queued data

  • External tools must connect from an allowed IP

Default Value

By default, new Key Value instances are not reachable at their external URL.

Pre-Requisites

  • Admin or Developer role (Admin for protected environments)

  • A list of IP ranges that need external access

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Key Value instance to open it.

  3. On the Info page, scroll down to the Networking section and review the allowed IP ranges.

  4. If the list contains 0.0.0.0/0, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Key Value instance to open it.

  3. On the Info page, scroll down to the Networking section.

  4. Remove 0.0.0.0/0 and add only your approved CIDR ranges, or remove all entries to disable external access, then save.

  5. Alternatively, run: render kv update <name> --ip-allow-list "cidr=203.0.113.5/32,description=office" (or --clear-ip-allow-list).

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Key Value instance to open it.

  3. In the Networking section, add back the removed ranges and save.

Reference