Managed AWS prefix lists for the third-party services in your traffic:
the ones your workloads call out to, and the ones that call in. Stripe, Datadog,
GitHub and dozens more, kept current in your account. Reference
pl-… in a security group rule and you're done. No agent, no proxy,
nothing of ours in your data path.
Locking down a VPC is a solved problem right up until the first
third-party dependency. Vendor IP ranges live in a dozen inconsistent formats and
churn without notice, and we
measured exactly how badly, vendor by vendor.
So most teams punch 0.0.0.0/0:443
into both sides and quietly give up the entire posture. Outbound, an attacker with a
foothold can exfiltrate anywhere on port 443. Inbound, your webhook endpoint takes a
POST from anyone who can reach it. PCI DSS 4.0 (req. 1.3.2) and your SOC 2 auditor
have opinions about both.
Every range comes from the vendor's official publication, with a provenance chain. Never widened, never summarized across gaps. The covered address set is preserved exactly.
Vendor rotations propagate to every consumer's security groups within minutes, with grace windows keeping old + new ranges live through the transition, so rotations are non-events.
Security groups are free, add zero latency, and your auditor already understands them. No gateway to operate, no vendor in your traffic path, nothing new to fail.
We publish each service's ranges as AWS-managed-style prefix lists and share them to your accounts via AWS RAM. One CloudFormation stack accepts the share and files the security-group quota increase your subscriptions need.
Use pl-… in security group rules exactly like an AWS-managed
prefix list: slash0.stripe.api.v4, slash0.datadog.agents.v4,
one list per service, purpose, and address family.
When the vendor's ranges change, the list updates and every referencing rule follows; typically inside the hour of the vendor publishing, and within a minute of the change landing in our feed. Staged rollouts hit our own canary account first; suspicious changes are quarantined before they ever publish; updates are signed end-to-end with an ECDSA P-256 signature over the feed index, every service document hash-chained to it, verified before anything is applied. You can verify that signature yourself.
Note: IP pinning only works for services with dedicated, published ranges. The catalog classifies every service and tells you plainly when a CDN-fronted service can't be pinned safely. It's a small set, and one unpinnable dependency doesn't cost you the rest: scope security groups per workload and it stays contained to the one service that needs it. Those services aren't out of reach either; a later phase adds hostname-aware egress enforcement that runs entirely in your VPC, built on this same catalog.
All of the data is free, permanently. The signed feed and the Terraform provider expose every service and purpose in the catalog, rebuilt continuously, with per-purpose scoping and change history. If you never pay slash0 anything, all of this is yours to use.
source = "slash0-io/ipranges".
Data sources for every service and purpose in the catalog.
registry ↗
Signed JSON at feed.slash0.io/v1, with sync tokens, provenance, and a changelog. One page per service, with current ranges and Terraform examples: browse the services →
The feed pipeline is open source, with every parser tested against archived vendor fixtures. github.com/slash0-io/feed ↗
Same data, plus the part worth paying for: we manage it in your account. Terraform data sources refresh only when you run an apply; the hosted tier removes that gap and everything else you would otherwise build around it.
Prefix lists update within a minute of a feed change. No applies, no Lambda updater to build, no drift between deploys.
Staged rollouts through a canary account, quarantine of suspicious changes, and grace windows that keep old and new ranges live through vendor rotations.
Onboarding computes the rules-per-group quota your subscriptions need and files the increase for you. List sizes are tuned so you spend as little quota as possible. estimate yours →
It is live and onboarding design partners now. Tell us which services you allowlist, or wish you could, and we'll reach out as slots open.