IP ranges to use Amazon RDS.

[holden]

I would like to use Amazon RDS with fly but it appears Fly uses different outbound IPs to access it.

I have added the IP for my Fly.io instance in Amazon RDS so it should have permission to use it but from what I can read in other threads fly uses different IP ranges for different regions.

I found some for AMS from 2022, but how can I get the current ranges in Fly so that I can add all of these to RDS? Eg I use AMS, DEN and sometimes DFW how can I white list all of these IP ranges so that I can use Amazon RDS?

Or is there an easier way?

I’ve also tried adding the IP which the instance seems to be using eg fdaa:3:40dd:a7b:15c:daf6:df09:2, I tried adding fdaa:3:40dd:a7b:15c:daf6:df09:2/128 to RDS inbound rultes but this doesn’t appear to work.

Thanks

[greg]

Hi,

Unfortunately Fly do not publish their IP ranges:

Request: Fly IP ranges

An issue we’ll run into with trying to publish IP ranges is we regularly add IPs, so even if we could provide an up-to-date page to pull them from, there would still be windows of time where the local copy your app would have would be out of sync. For a security-relevant feature, it’s probably better to keep it clear that our IP addresses are subject to change.

You are correct - they will vary per region. Which adds an extra complication.

You also can’t get a static outbound IP (e.g to use in an RDS security group) from Fly. As you’ve seen, the IP you are shown is for incoming connections. Like for a DNS A/AAAA record to point a custom domain at your app.

You have probably already seen this thread but if you scroll up and down it you may see some ideas, like:

Request: Fly IP ranges

We do have a decent example of how to connect to an RDS instance, it runs a wireguard peer + pgbouncer within a VPC: GitHub - fly-apps/rds-connector: Trivial Terraform example for a WireGuard peer to RDS The best way to do this is to create “gateways” in your Azure or AWS private networks. You make Fly wireguard peers work, or you can run something like Tailscale in your app instances and let it manage all that. As much as I hate IP allow lists, we might have what you need to use those in a fe…