# Reduce public attack surface across managed clusters with Zero Inbound Access [Blog](/blog/)>[Security](/blog/category/security/)>Reduce public attack surface across managed clusters with Zero Inbound Access Reduce public attack surface across managed clusters with Zero Inbound Access ============================================================================= August 27, 2026 | By [ Mitch O'Dea](https://www.instaclustr.com/blog/author/mitchodea/) [ ](https://x.com/intent/tweet?text=Reduce%20public%20attack%20surface%20across%20managed%20clusters%20with%20Zero%20Inbound%20Access&url=https://www.instaclustr.com/blog/reduce-public-attack-surface-across-managed-clusters-with-zero-inbound-access/) [ ](https://www.linkedin.com/shareArticle?mini=true&url=https://www.instaclustr.com/blog/reduce-public-attack-surface-across-managed-clusters-with-zero-inbound-access/&title=&summary=Reduce%20public%20attack%20surface%20across%20managed%20clusters%20with%20Zero%20Inbound%20Access&source=) Running a private network cluster to meet strict compliance and security obligations creates a new problem: how do you gain management access to those private resources without increasing your public attack surface? A common setup is a bastion host that provides access into the private network cluster. This is the model NetApp Instaclustr previously used, and for many deployments it is sufficient. However, at its core, it still requires inbound network access over a publicly routable IP address along with the additional networking complexity and management overhead. In short, Zero Inbound Access helps organizations reduce public attack surface by removing publicly routable IPs from Instaclustr-managed clusters while preserving full managed service operations through outbound connectivity. That changes today. Zero Inbound Access is now Generally Available across AWS, Azure, GCP, and on-premises infrastructure for every managed application on the NetApp Instaclustr Managed Platform. It is available for Bring Your Own Cloud (BYOC) and on-premises deployments, but not for Run In Instaclustr’s Account (RIIA) deployments. Zero Inbound Access is an enterprise feature, with no additional cost if you are already running a private network cluster or any other enterprise feature. What Is Zero Inbound Access? ---------------------------- Zero Inbound Access removes publicly routable IP from your Instaclustr managed cluster, including the bastion instance that a standard private network cluster requires. Instead of Instaclustr reaching in to manage your nodes, each node initiates an outbound connection through a NAT gateway to Instaclustr’s management infrastructure. No inbound firewall rules are required, and no publicly routable IPs are required in your deployment. Instaclustr retains full management capability, including patching, node replacement, incident response through that outbound path. The difference is that nothing outside of your cluster network can initiate a connection inward. For architecture details, setup steps, and current limitations, see the [Zero Inbound Access](https://www.instaclustr.com/support/documentation/useful-information/zero-inbound-access/) documentation. What Zero Inbound Access Means for Your Security Posture -------------------------------------------------------- ### No publicly routable IPs, anywhere Standard private network clusters remove public IPs from application nodes. Zero Inbound Access removes the remaining public IP on the management path so your entire cluster footprint is off the public internet. The architecture is designed tp esnure nothing in your deployment is exposed through an external network scan. ### No compromise on manageability Removing inbound access does not reduce the ability of Instaclustr to manage your cluster. Patching, node replacement, scaling, and incident response all operate through the outbound path. You get maximum network isolation without giving up operational coverage. ### Works across supported applications and cloud Zero Inbound Access is available for all managed applications on the Instaclustr platform across AWS, Azure, GCP, and on-premises infrastructure. This feature is also fully supported under our PCI-DSS enabled offering. ### No additional cost for existing enterprise customers For existing customers running private network clusters, Zero Inbound Access adds no incremental cost. ### Get Started If you are provisioning a new cluster, enable Zero Inbound Access on the Create Cluster page in the Instaclustr Console, or configure it via the cluster management API or Terraform provider. If you are running an existing private network cluster and want to migrate, you can enable Zero Inbound Access from the setting tab in the Instaclustr Console for that cluster. This functionality is also available through Terraform or the cluster management API. For full setup steps and current limitations, see our [Zero Inbound Access documentation](https://www.instaclustr.com/support/documentation/useful-information/zero-inbound-access/). ![mail icon]()#### Get the latest articles for open sourceIn your inbox Sign up now ### Related content [ Zero Downtime Migration to Instaclustr Yes, we can migrate existing Cassandra clusters to Instaclustr without any downtime. Here's what to expect from the process... ](https://www.instaclustr.com/blog/zero-downtime-migration-to-instaclustr/) [ Workflow Comparison: Uber Cadence vs Netflix Conductor When choosing what’s right for your company’s opensource workflow needs it is important to know the difference and similarities ... ](https://www.instaclustr.com/blog/workflow-comparison-uber-cadence-vs-netflix-conductor/) [ Will Your Cassandra Database Project Succeed?: The New Stack Open source Apache Cassandra® continues to stand out as an enterprise-proven solution for organizations seeking high availability... ](https://www.instaclustr.com/blog/will-your-cassandra-database-project-succeed-the-new-stack/) ×Sign upto ourNewsletter -----------------------