Skip to main content

Allowlist Atlan IPs in AlloyDB authorized networks

TL;DR

Enable a public IP on your AlloyDB for PostgreSQL instance and admit only Atlan's tenant-specific egress IPs through authorized networks.

Connect

If your security policy allows an internet-reachable database restricted to known addresses, enable a public IP on the instance and admit only Atlan's tenant-specific egress IPs. Fastest path - one support ticket for the IP list.

Do I need this?​

  • Yes, if you chose the public path on the chooser page and your instance has (or can have) a public IP.
  • No, if your AlloyDB is private-IP only and must stay that way - use the self-deployed runtime or PSC instead. There is no allowlist that makes a private IP reachable from Atlan.

Steps​

  1. Atlan User - Raise a support request with your tenant URL, asking for your tenant's public egress (NAT) IPs. They are provisioned per tenant; there is no shared table to copy from (see Atlan Network Details).
  2. Google Cloud admin - Enable a public IP on the AlloyDB instance (Connectivity settings). Note the assigned address.
  3. Google Cloud admin - Add each Atlan egress IP to the instance's authorized external networks:
gcloud alloydb instances update my-instance \
  --cluster=my-cluster --region=us-central1 \
  --assign-inbound-public-ip=ASSIGN_IPV4 \
  --authorized-external-networks=203.0.113.10/32,203.0.113.11/32  # ← your tenant's IPs from support
  1. Atlan User - In New workflow → AlloyDB Assets (Direct extraction), enter the instance's public IP or public DNS name as Host, port 5432, credentials, then Test connection.
Do not enter the private IP as Host

With a public IP enabled, the instance has two addresses. The Host field must contain the public one. Entering the private 10.x.x.x address fails from Atlan's side with app internal error: 500 at test time - the most common first-time setup failure across GCP database connectors.

Every IP, exactly as given

Add all IPs support lists for your tenant, as /32 entries (or the exact CIDR given). Outbound traffic rotates across the tenant's egress addresses - allowlisting only the one you saw in a log causes intermittent, hard-to-diagnose timeouts.

Encryption​

Connections use TLS. If your organization enforces ssl requirements on the AlloyDB side, no crawler change is needed - the connector negotiates TLS by default. Custom certificate requirements should be mentioned on your support ticket.

When Atlan's IPs change​

Because the values are tenant-specific, changes are communicated on your ticket and to tenant admins by email. If a long-working connection starts timing out with no change on your side, re-confirm the current IPs with support first - see Troubleshooting AlloyDB connectivity.