| purpose | direction | IPv4 | IPv6 |
|---|---|---|---|
paypal/all | both | · | · |
paypal/all
Direction: both. PayPal publishes these ranges for traffic in either direction; use them in the rule direction your integration needs. The example below shows egress.
loading ranges from the feed…
This purpose currently publishes more IPv4 ranges than the default rules-per-SG quota (60). Each CIDR consumes one rule; the hosted prefix list spends quota once per list instead. Details in the FAQ.
Terraform
data "ipranges_egress" "paypal_all" {
service = "paypal"
purpose = "all"
}
resource "aws_security_group_rule" "paypal_all" {
type = "egress"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = data.ipranges_egress.paypal_all.ipv4_cidrs
security_group_id = aws_security_group.app.id
}
keep rules current automatically
Terraform data sources refresh only when you run an apply. The hosted tier publishes the same data via AWS managed prefix lists (slash0.paypal.all.v4 and so on), shared into your account via AWS RAM: rules reference one pl-… id and update within a minute of a vendor change, with removals held through a 72 hour grace window. Request early access or read how it works.
provenance
Ranges come from PayPal's official publication: https://www.paypal.com/us/cshelp/article/what-are-the-internet-protocol-ip-addresses-for-paypal-server-endpoints-ts1056. Fetched sources:
Every publish is signed (ECDSA P-256 over the feed index, each service document hash-chained to it) and every range change is recorded in the changelog. Verification steps: security. Provider setup: quickstart.