Outgoing IP ranges: Dynamic egress IPs for IDE Services Cloud

Problem

Requests from dynamic egress IPs (e.g., 18.201.1.131) for IDE Services Cloud were observed, leading to uncertainty regarding IP allowlisting for OAuth server configurations protected by firewall rules.

Cause

JetBrains IDE Services Cloud utilizes dynamic egress IP addresses from AWS infrastructure that change as the infrastructure scales, making it not feasible to provide a static list of outgoing IPs for allowlisting.

Resolution

JetBrains does not provide a fixed CIDR list for outgoing IPs. However, the following steps can help configure firewall rules to handle dynamic egress IPs:

1. Refer to AWS’s published ranges for the relevant region (e.g., eu-west-1) and service (EC2). Update your firewall rules on a schedule using this information.

   • AWS IP Ranges Documentation
   • Understanding AWS IPs syntax

2. Fetch the JSON file of AWS IP ranges directly from their documentation, which includes all the IP ranges used by AWS services globally. Use tools like AWS Tools for PowerShell or jq in Linux for parsing.

   • AWS IP Ranges JSON file

3. If Keycloak is fronted by AWS services (such as CloudFront or AWS VPC Security Groups), consider using AWS-managed prefix lists for these services instead of polling for raw CIDR ranges.

   • CloudFront Locations of Edge Servers

Using these approaches enables dynamically updating firewall rules while maintaining compatibility with JetBrains IDE Services Cloud's egress traffic.