Skip to main content

Setting Up IP Address Whitelisting for DataHub Cloud

Angelo Bresci
Updated

Area: Deployment Issues

Sub-Area: Network Security Configuration

Issue

DataHub Cloud customers need to restrict access to their instances by implementing IP address whitelisting to block unauthorized access from outside their organization's approved network ranges. This is commonly required for security compliance and to meet InfoSec requirements for production environments.

You Might Be Asking

  • How do I restrict access to my DataHub Cloud instance to specific IP addresses?
  • Can I configure IP whitelisting myself in DataHub Cloud?
  • Will IP restrictions affect both the UI and API access?
  • How does this work for multiple environments (test and production)?

Solution

  1. Contact DataHub Support: IP whitelisting is a managed feature in DataHub Cloud. You cannot configure these controls directly as a customer.
  2. Provide your IP addresses: Submit a support request with the complete list of IP addresses that should be allowed access to your DataHub Cloud instance(s).
  3. Specify your environments: Clearly indicate which DataHub Cloud instances need IP restrictions (e.g., production, test, staging).
  4. Include format like this example: 
    Instance: <your-instance>.acryl.io
Instance: <your-test-instance>.acryl.io

Allowed IP addresses:
192.168.1.100
10.0.0.50
203.0.113.25
198.51.100.75
  5. Wait for implementation: The Acryl team will configure IP allowlisting at the API gateway and load balancer layer using AWS Application Load Balancer (ALB) ingress annotations.
  6. Verification: Once implemented, test access from both allowed and blocked IP addresses to confirm the restriction is working correctly.

Additional Notes

IP whitelisting in DataHub Cloud uses a dual-ingress pattern to ensure Acryl support team access via VPN is preserved while blocking unauthorized external access. The implementation is done at the infrastructure level using AWS ALB inbound-cidrs annotations, ensuring both UI and API access are restricted. Each customer deployment gets a unique ALB group to prevent restrictions from affecting other customers. This feature is not available in self-hosted DataHub deployments, where customers must manage their own networking and security controls.

Related Documentation

Tags: ip-whitelisting, network-security, datahub-cloud, access-control, deployment, infrastructure, security-compliance, managed-service, load-balancer, aws-alb

Related articles