What IP ranges do you need to allow for a locked down server to use the Canvas API without issues?

[llawson]

Hello, I have a standalone server that regularly makes API requests to our Canvas instance (us-east-1) to launch reports, then eventually download them when they are complete. On this server we have had several issues with the script timing out if running it as a batch. Now Amazon has a JSON reference that tells you which IP ranges belong to which region, which is great. However for Canvas, is it necessary to allow all of the ranges? There are apparently three different services: AMAZON, S3 (used for reports if I remember correctly), and EC2.

Thanks for your help.

[stuart_ryan]

Hi llawson‌,

Great question, I have never seen a published list of IP addresses for Canvas, I would assume they simply use allocated IP addresses from within those ranges that Amazon publishes.

For good measure, I would suggest allowing everything in those ranges to be the best option. In the absence of a similar published range by Instructure, doing so would avoid any manual changes required if and when Instructure adds new servers to the cluster etc.

However, I am curious to understand your use case a little more, you mention you are having timeouts when running in batch. If this is the issue, adding IP ranges would have no effect (if you can get through firewalls etc to make a connection, a timeout would be a different problem).

Incidentally, a few moments ago I wrote up a post which could be highly relevant to your situation https://community.canvaslms.com/thread/22272-canvas-api-request-timeout-issue#comment-97010.

I would be curious to hear your thoughts, and more on the issue you are facing, to see if we can get to the bottom of it.

Hope that helps!

Stuart