Skip to main content

IP Allowlist

If your data warehouse restricts inbound connections by IP address, you will need to allowlist the dbdeux compute engine IPs so that runs can connect to your warehouse.

When You Need This​

IP allowlisting is required if:

  • Your Snowflake account uses network policies
  • Your Redshift cluster is in a private VPC with security group restrictions
  • Your organization requires explicit IP-based access control

Not required for:

  • Google BigQuery (authentication via service account keys, no IP restrictions)
  • Amazon Athena (authentication via IAM, no IP restrictions)

Static Egress IPs​

All dbt runs from dbdeux originate from static, predictable IP addresses. These IPs are stable and do not change without advance notice.

info

Contact our support team at support@dbdeux.io to receive the current list of egress IPs for your region.

Setup by Warehouse​

Snowflake​

Create a network policy that allows dbdeux IPs:

-- Create a network policy for dbdeux access
CREATE NETWORK POLICY dbdeux_access
  ALLOWED_IP_LIST = ('x.x.x.x', 'y.y.y.y');

-- Apply to the dbdeux service user
ALTER USER DBT_USER SET NETWORK_POLICY = dbdeux_access;
tip

Apply the network policy to the specific dbdeux service user rather than at the account level. This ensures other users are not affected.

Redshift​

Add the dbdeux IPs to your VPC security group:

  1. Open the AWS Console → VPC → Security Groups
  2. Find the security group attached to your Redshift cluster
  3. Add inbound rules for each dbdeux IP on port 5439 (TCP)
  4. Save the rules

If using Redshift Serverless, update the VPC security group associated with your serverless workgroup.

Athena​

Athena access is controlled via IAM policies, not IP allowlisting. Ensure the IAM credentials you provide to dbdeux have appropriate permissions to:

  • Execute queries via the Athena API
  • Read/write to the S3 staging directory
  • Access the Glue Data Catalog

Verification​

After configuring your allowlist:

  1. Go to Settings → Connections in dbdeux
  2. Click Test Connection on the relevant connection
  3. A successful test confirms that the IPs are allowlisted correctly

IP Change Notifications​

In the rare event that our egress IPs change, we provide:

  • 30 days advance notice via email to all organization Admins
  • A transition period where both old and new IPs are active simultaneously
  • Updated documentation with the new IP list

Questions?​

If you have trouble configuring IP allowlisting, contact support at support@dbdeux.io and we will help you get connected.