Skip to main content

Firewall & IP allowlisting

Connect docs via MCP
TL;DR

Allow Atlan's fixed source IPs through your security group so crawlers and miners can connect to publicly accessible Amazon Redshift clusters and workgroups.

For publicly accessible clusters and workgroups: permit Atlan's fixed source IPs through your security group so crawlers and miners can connect on port 5439.

Do I need this?​

  • Yes, if you connect over the public path - every Redshift cluster sits behind a security group, and its default inbound rules won't include Atlan.
  • No, if you use the private network link - traffic arrives through the managed endpoint, not from Atlan's public IPs.
  • Also check: the cluster's Publicly accessible setting must be on for the public path to work at all. A security-group rule can't help a cluster that has no public address.

Steps​

  1. Atlan User - Get your tenant's public egress (NAT) IPs: raise a support ticket with your tenant URL (values are tenant-specific - see Atlan Network Details).
  2. AWS / Redshift admin - In the AWS console, open the cluster (or Serverless workgroup) and find its VPC security group under Properties → Network and security settings.
  3. Add an inbound rule per Atlan IP: Type Redshift, Protocol TCP, Port 5439 (or your custom port), Source <atlan-ip>/32.
  4. Check nothing else blocks the path: network ACLs on the subnet, or a corporate firewall in front of AWS.
# Security group inbound rules - one per Atlan egress IP (illustrative IPs)
Type: Redshift   Protocol: TCP   Port: 5439   Source: 203.0.113.10/32   # Atlan egress 1
Type: Redshift   Protocol: TCP   Port: 5439   Source: 203.0.113.11/32   # Atlan egress 2
Allowlist every IP support sends

Your tenant may egress from more than one IP. Allowlisting only the first one causes intermittent failures - workflows pass some hours and time out others, depending on which IP the traffic leaves from. Add them all.

SSL / TLS​

Atlan supports connecting to Redshift over SSL, including clusters that enforce it with the require_SSL parameter - no extra crawler configuration is needed.

Verify it worked​

Run Test connection in the crawler setup. A timeout after ~30 seconds almost always means the security group (or the Publicly accessible setting) - an authentication error means the network path is fine; check credentials instead. That distinction is the fastest triage you can do; see Troubleshooting Amazon Redshift connectivity.

Next steps​

Set up access and authentication: Create the database user and configure authentication so Atlan can connect to your cluster.