Overview
Whitelisting is a cybersecurity strategy that identifies statically assigned IP addresses for specific application resources, filtering all communications traffic to accept only those addresses.
Because the Pacejet platform utilizes cloud-based software with a modern "elastic" cloud architecture, application resources are dynamically "added or removed" as user loads change during the day. This provides a tremendous advantage to users because aplication resources are not limited to preset configurations, but it does create special requirements where IP whitelisting is concerned.
Domain Based White Listing
For inbound traffic to Pacejet, whitelisting domain names provides the most flexibility and is the recommended solution. For example, if your provisioned Pacejet location uses the address https://ship.pacejet.cc/MyCompany, you would whitelist the ship.pacejet.cc domain to restrict browser communications to this specific website address. For API traffic you would whitelist shipapi.pacejet.cc.
IP Address Whitelisting
IP address whitelisting is possible for outbound traffic from Pacejet through two methods. The first method is to whitelist all IP addresses available from Amazon Web Services (AWS); the second method is to whitelist only Pacejet resource IPs.
The first method is harder to implement but requires less maintenance, since it is based on the full range of AWS addresses. The second method is easier to implement but more likely to require maintenance should Pacejet be required IP address changes.
Option 1: Whitelist all AWS IP Addresses:
-
Whitelist the full set of AWS IP addresses, which includes thousands of addresses
-
AWS IP address ranges information and downloads are published here:
https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.htmlExternal links are maintained by third parties and are provided here as a convenience only. Descartes does not endorse, approve or make any claims as to the accuracy or reliability of the contents, which may be changed from time to time by the third party without warning.
The specific dynamic AWS IP ranges are published here:
https://ip-ranges.amazonaws.com/ip-ranges.json
-
Option 2: Whitelist specific Pacejet resource IPs
-
Whitelist the following IP addresses:
54.163.90.180
54.145.46.189
34.224.196.88
54.225.64.53
3.228.253.118
35.173.56.151
54.70.235.2
34.211.194.218
https: port 443
http: port 80
wss://37y0v7j8u3.execute-api.us-east-1.amazonaws.com/Prod/
wss://86i9s3l4kh.execute-api.us-east-2.amazonaws.com/Test/
ship.pacejet.cc
shipapi.pacejet.cc
startapi.pacejet.cc
start.pacejet.cc
Be prepared to change your whitelisting at any time in the future
Pacejet does not expect these addresses to change frequently, but we reserve the right to modify them at any time
This KBA will be updated when any of the IP addresses change
Define Your Change Process Proactively
Because whitelisting is likely to conflict with resource management changes in the future, Pacejet recommends an alert, short-term response, and support process for monitoring and maintain whitelisted IP addresses.
The following is a sample internal change management process that aligns with Pacejet support:
Determine how your team will be alerted should whitelisting block communications
Create an internal process to temporarily remove white listing when a whitelisted IP address change occurs
When alerted to a change, institute the process for temporary whitelisting removal
When alerted to a change, refer back to this article for any new/changed whitelist resource IPs (see above)
Restore your whitelisting process after any new/changed IP addresses have been added
Do NOT restore whitelisting if the new addresses do not provide communications support
If the above does not work properly Enter a Pacejet support ticket and request it to be escalated