{"token_count": 586}

# Reference for the teleport\_client\_ip\_restriction Terraform resource

This page lists the supported values of the teleport\_client\_ip\_restriction resource of the Teleport Terraform provider.

## Schema

### Optional

- `metadata` (Attributes) Metadata about the client IP restrictions. (see [below for nested schema](#nested-schema-for-metadata))
- `spec` (Attributes) User-configurable parts of the resource settings. (see [below for nested schema](#nested-schema-for-spec))
- `sub_kind` (String) The sub\_kind of the resource. Always "".
- `version` (String) The version of the resource. Always "v1".

### Nested Schema for `metadata`

Optional:

- `description` (String) description is object description.
- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
- `labels` (Map of String) labels is a set of labels.
- `name` (String) name is an object name.

### Nested Schema for `spec`

Optional:

- `allowed_cidrs` (List of String) allowed\_cidrs is the list of CIDR blocks permitted to connect to the cluster. An empty list disables restrictions and allows all traffic.
- `expires` (String) expires is the deadline on enforcement: the restriction is enforced until this time and not after it. An unset value means enforcement never lapses. When set, it must be at least 20 minutes in the future. Once it elapses, enforcement stops and status.state becomes "expired". Neither mode nor expires is modified by Teleport Cloud, so a lapsed restriction still reads as enforced with an elapsed expiry; enforcing again takes a new write. Whether the restriction is in effect is therefore derived from this field and mode, not stored on its own. Note: we do not use the `metadata.expires` field for this, because that conventionally denotes that the resource should be deleted once it elapses. Here expiry only stops enforcement on the Cloud side; the resource itself keeps existing rather than being removed. Writes fully replace the resource, so a client editing other fields must re-send a still-valid expiry or clear it. An expiry read earlier and passed back unchanged can be rejected once it is under 20 minutes away.
- `mode` (String) mode is the user-controlled operational mode of the restriction. It denotes intent; the actual enforcement state is reported by status.state. Possible values: "draft" (configured but not enforced) and "enforced" (should be enforced by Teleport Cloud). An empty value is treated as "enforced" for backward compatibility.