services / okta

Okta IP ranges

Official Okta ranges from the vendor's publication, split by purpose: all, pam-emea, pam-us, preview-emea, preview-pam, preview-us, production-australia, production-canada, production-germany, production-hipaa, production-india, production-ireland, production-japan, production-us, us-cell-20, us-cell-22. The ranges below render live from the signed slash0 feed.

purposedirectionIPv4IPv6
okta/allboth··
okta/pam-emeaboth··
okta/pam-usboth··
okta/preview-emeaboth··
okta/preview-pamboth··
okta/preview-usboth··
okta/production-australiaboth··
okta/production-canadaboth··
okta/production-germanyboth··
okta/production-hipaaboth··
okta/production-indiaboth··
okta/production-irelandboth··
okta/production-japanboth··
okta/production-usboth··
okta/us-cell-20both··
okta/us-cell-22both··

okta/all

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_all" {
  service = "okta"
  purpose = "all"
}

resource "aws_security_group_rule" "okta_all" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_all.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/pam-emea

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_pam_emea" {
  service = "okta"
  purpose = "pam-emea"
}

resource "aws_security_group_rule" "okta_pam_emea" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_pam_emea.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/pam-us

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_pam_us" {
  service = "okta"
  purpose = "pam-us"
}

resource "aws_security_group_rule" "okta_pam_us" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_pam_us.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/preview-emea

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_preview_emea" {
  service = "okta"
  purpose = "preview-emea"
}

resource "aws_security_group_rule" "okta_preview_emea" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_preview_emea.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/preview-pam

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_preview_pam" {
  service = "okta"
  purpose = "preview-pam"
}

resource "aws_security_group_rule" "okta_preview_pam" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_preview_pam.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/preview-us

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_preview_us" {
  service = "okta"
  purpose = "preview-us"
}

resource "aws_security_group_rule" "okta_preview_us" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_preview_us.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-australia

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_australia" {
  service = "okta"
  purpose = "production-australia"
}

resource "aws_security_group_rule" "okta_production_australia" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_australia.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-canada

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_canada" {
  service = "okta"
  purpose = "production-canada"
}

resource "aws_security_group_rule" "okta_production_canada" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_canada.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-germany

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_germany" {
  service = "okta"
  purpose = "production-germany"
}

resource "aws_security_group_rule" "okta_production_germany" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_germany.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-hipaa

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_hipaa" {
  service = "okta"
  purpose = "production-hipaa"
}

resource "aws_security_group_rule" "okta_production_hipaa" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_hipaa.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-india

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_india" {
  service = "okta"
  purpose = "production-india"
}

resource "aws_security_group_rule" "okta_production_india" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_india.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-ireland

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_ireland" {
  service = "okta"
  purpose = "production-ireland"
}

resource "aws_security_group_rule" "okta_production_ireland" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_ireland.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-japan

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_japan" {
  service = "okta"
  purpose = "production-japan"
}

resource "aws_security_group_rule" "okta_production_japan" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_japan.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/production-us

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_production_us" {
  service = "okta"
  purpose = "production-us"
}

resource "aws_security_group_rule" "okta_production_us" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_production_us.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/us-cell-20

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_us_cell_20" {
  service = "okta"
  purpose = "us-cell-20"
}

resource "aws_security_group_rule" "okta_us_cell_20" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_us_cell_20.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

okta/us-cell-22

Direction: both. Okta publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.

loading ranges from the feed…

Terraform

data "ipranges_egress" "okta_us_cell_22" {
  service = "okta"
  purpose = "us-cell-22"
}

resource "aws_security_group_rule" "okta_us_cell_22" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.okta_us_cell_22.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

keep rules current automatically

Terraform data sources refresh only when you run an apply. The hosted tier publishes the same data via AWS managed prefix lists (slash0.okta.all.v4 and so on), shared into your account via AWS RAM: rules reference one pl-… id and update within a minute of a vendor change, with removals held through a 72 hour grace window. Request early access or read how it works.

provenance

Ranges come from Okta's official publication: https://help.okta.com/en-us/content/topics/security/ip-address-allow-listing.htm. Fetched sources:

Every publish is signed (ECDSA P-256 over the feed index, each service document hash-chained to it) and every range change is recorded in the changelog. Verification steps: security. Provider setup: quickstart.