Skip to main content

Firewall & IP allowlisting

TL;DR

Allow Atlan's fixed source IPs through your security group so crawlers and miners can connect to publicly accessible Amazon Redshift clusters and workgroups.

Your AI can read this via Docs MCPInstall MCP →Connect

For publicly accessible clusters and workgroups: permit Atlan's fixed source IPs through your security group so crawlers and miners can connect on port 5439.

Do I need this?​

  • Yes, if you connect over the public path - every Redshift cluster sits behind a security group, and its default inbound rules won't include Atlan.
  • No, if you use the private network link - traffic arrives through the managed endpoint, not from Atlan's public IPs.
  • Also check: the cluster's Publicly accessible setting must be on for the public path to work at all. A security-group rule can't help a cluster that has no public address.

Steps​

  1. Atlan User - Get your tenant's public egress (NAT) IPs: raise a support ticket with your tenant URL (values are tenant-specific - see Atlan Network Details).
  2. AWS / Redshift admin - In the AWS console, open the cluster (or Serverless workgroup) and find its VPC security group under Properties → Network and security settings.
  3. Add an inbound rule per Atlan IP: Type Redshift, Protocol TCP, Port 5439 (or your custom port), Source <atlan-ip>/32.
  4. Check nothing else blocks the path: network ACLs on the subnet, or a corporate firewall in front of AWS.
# Security group inbound rules - one per Atlan egress IP (illustrative IPs)
Type: Redshift   Protocol: TCP   Port: 5439   Source: 203.0.113.10/32   # Atlan egress 1
Type: Redshift   Protocol: TCP   Port: 5439   Source: 203.0.113.11/32   # Atlan egress 2
Allowlist every IP support sends

Your tenant may egress from more than one IP. Allowlisting only the first one causes intermittent failures - workflows pass some hours and time out others, depending on which IP the traffic leaves from. Add them all.

SSL / TLS​

Atlan supports connecting to Redshift over SSL, including clusters that enforce it with the require_SSL parameter - no extra crawler configuration is needed.

Verify it worked​

Run Test connection in the crawler setup. A timeout after ~30 seconds almost always means the security group (or the Publicly accessible setting) - an authentication error means the network path is fine; check credentials instead. That distinction is the fastest triage you can do; see Troubleshooting Amazon Redshift connectivity.

Next steps​

Set up access and authentication: Create the database user and configure authentication so Atlan can connect to your cluster.