Can I allow Transloadit's IPs in my firewall?
Our platform is highly volatile in the sense that we'll have 1000 servers online today that will be gone tomorrow. Trying to keep your firewalls up to date with this pace is asking for dropped connections.
We don't funnel outgoing connections (e.g. 🤖/sftp/store or Notifications or 🤖/http/import) through one point because of performance and SPOF reasons. Using a fleet of proxies that scale along with load puts us back in the same problem, and using NAT has prohibitive limitations performance-wise. The trade-off of our decision to have maximum reliability & throughput is that our outgoing IPs change rapidly.
Ingress (Transloadit pinging your server, acquiring results)
The 'best' we can do is give you your region's Amazon ranges, but obviously you will be allowing a lot more than you bargained for. On the other hand you'll still rule out 99% of the internet, so for some less critical use cases it could be viable. We'll refer to them just in case.
An up to date Amazon IP list is available, that page also lists a JSON variant for automation.
A better solution you could implement, if security is paramount, is to setup a server outside of your trusted zone that we'll push updates to. Machines inside your trusted zone could then pull updates from this machine using rsync, a database, or ZeroMQ (collect Notifications and have your trusted zone eat through this queue). This way you will only have to deal with a limited set of known IPs. Additionally, this will cover the security risk that, should our machines ever get compromised, there is a allowlisted connection straight into your trusted zone. We'd push file results to an S3 bucket with append-only access, and you can then from inside your DMZ safely pull them in.
For a near-real-time approach, something like HAProxy (directly forward traffic into your trusted
zone), direct routing, or SSH tunnelling the notify_url into your DMS will work.
Egress (Client-side integrations talking to Transloadit)
If you're deploying a client-side integration of Transloadit (like Uppy) with a corporation that puts restrictions on internet use, please allow these domains:
*.transloadit.com*.*.transloadit.coms3.amazonaws.coms3-eu-west-1.amazonaws.com