quickstart

1. add the provider

terraform {
  required_providers {
    egress = {
      source = "slash0-io/egress"
    }
  }
}

provider "egress" {}

2. pull the ranges you need

One data source per service and purpose. Every slug and purpose is listed in the catalog.

# ranges your workloads connect out to (egress direction)
data "egress_ranges" "stripe_api" {
  service = "stripe"
  purpose = "api"
}

# ranges a service connects to you from (ingress direction:
# webhook and agent sources belong in ingress rules)
data "egress_ranges" "github_hooks" {
  service = "github"
  purpose = "hooks"
}

3. reference them in a security group rule

resource "aws_security_group_rule" "stripe_egress" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.egress_ranges.stripe_api.ipv4_cidrs
  security_group_id = aws_security_group.app.id
  description       = "Stripe API (feed ${data.egress_ranges.stripe_api.sync_token})"
}

After apply, the egress rule allows only Stripe's published API ranges.

notes

• Source of the data. The provider reads the signed public feed, which is built from each vendor's own publication. Third-party aggregators are not used. Each service document records the upstream URL, retrieval time, and content hash.
• Direction. Purposes marked egress are destinations for outbound rules. Purposes marked ingress (webhooks, agents, synthetic probes) are sources for inbound rules. The catalog labels every purpose.
• Refresh timing. Data sources refresh at plan time, so ranges drift between applies. The hosted tier exists to remove that gap: the same ranges as managed prefix lists, updated continuously without an apply.
• Quota. Every CIDR consumes one security group rule (default 60 per group). The catalog shows each purpose's rule count.

next

How it works describes the full pipeline. Security includes commands to verify the feed signature.