# Ensure Key Value external access is restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876669481998-ensure-key-value-external-access-is-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Render Key Value instance either has external connections disabled or allows them only from approved IP ranges, and never allows 0.0.0.0/0. Services in the same region can still connect using the internal URL.

**Rationale**

Key Value instances often store sessions, tokens, and job data. Allowing external access from any IP lets anyone on the internet try to connect, and a leaked password would give full access. Keeping external access off, or limited to known IPs, protects this data.

**Impact**

-   Only approved IP ranges can connect from outside Render
    
-   Reduces exposure of cached and queued data
    
-   External tools must connect from an allowed IP
    

**Default Value**

By default, new Key Value instances are not reachable at their external URL.

**Pre-Requisites**

-   Admin or Developer role (Admin for protected environments)
    
-   A list of IP ranges that need external access
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Key Value instance to open it.
    
3.  On the Info page, scroll down to the Networking section and review the allowed IP ranges.
    
4.  If the list contains 0.0.0.0/0, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Key Value instance to open it.
    
3.  On the Info page, scroll down to the Networking section.
    
4.  Remove 0.0.0.0/0 and add only your approved CIDR ranges, or remove all entries to disable external access, then save.
    
5.  Alternatively, run: render kv update <name> --ip-allow-list "cidr=203.0.113.5/32,description=office" (or --clear-ip-allow-list).
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Key Value instance to open it.
    
3.  In the Networking section, add back the removed ranges and save.
    

**Reference**

-   [https://render.com/docs/key-value](https://render.com/docs/key-value)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.