services / ibm-cloud

IBM Cloud (Classic infrastructure) IP ranges

Official IBM Cloud (Classic infrastructure) ranges from the vendor's publication, split by purpose: frontend, load-balancers. The ranges below render live from the signed slash0 feed.

purposedirectionIPv4IPv6
ibm-cloud/frontendegress··
ibm-cloud/load-balancersegress··

ibm-cloud/frontend

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "ibm_cloud_frontend" {
  service = "ibm-cloud"
  purpose = "frontend"
}

resource "aws_security_group_rule" "ibm_cloud_frontend" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.ibm_cloud_frontend.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

ibm-cloud/load-balancers

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "ibm_cloud_load_balancers" {
  service = "ibm-cloud"
  purpose = "load-balancers"
}

resource "aws_security_group_rule" "ibm_cloud_load_balancers" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.ibm_cloud_load_balancers.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

keep rules current automatically

Terraform data sources refresh only when you run an apply. The hosted tier publishes the same data via AWS managed prefix lists (slash0.ibm-cloud.frontend.v4 and so on), shared into your account via AWS RAM: rules reference one pl-… id and update within a minute of a vendor change, with removals held through a 72 hour grace window. Request early access or read how it works.

provenance

Ranges come from IBM Cloud (Classic infrastructure)'s official publication: https://cloud.ibm.com/docs/infrastructure-hub?topic=infrastructure-hub-ibm-cloud-ip-ranges. Fetched sources:

Every publish is signed (ECDSA P-256 over the feed index, each service document hash-chained to it) and every range change is recorded in the changelog. Verification steps: security. Provider setup: quickstart.