Network access policies
Network access policies control outbound connections from sandboxes. Each policy contains one or more rules that allow the domains, IP ranges, and ports a workflow needs, or block destinations that should stay unavailable.
You can configure network access in two places:
- Local policy, which applies to sandboxes on one developer machine when organization governance is not active.
- Organization policies, which apply centrally across an organization or to selected teams.
When organization governance is active, organization network rules replace local rules. Local rules are inactive until organization governance no longer applies.
Rule syntax
Network rules use the actions connect:tcp and connect:udp. Resources are
hostnames, CIDR ranges, ports, or hostnames with ports.
Examples:
api.example.com*.example.com**.example.comexample.com:44310.0.0.0/8
For exact wildcard behavior and CIDR support, see Network rules.
Local network rules
Use sbx policy allow network and sbx policy deny network to manage local
network rules:
$ sbx policy allow network api.example.com
$ sbx policy deny network ads.example.com
For presets, sandbox-scoped rules, testing, and troubleshooting, see Local policy.
Organization network rules
Organization network rules belong to policies that can apply to the whole organization or to selected teams. For setup steps and team scoping, see Organization policies.
Use Monitoring policies to inspect which network rules are active on a developer machine.