Skip to main content

Dagster+ IP addresses

The Dagster+ web interface, CLI, and GraphQL API use AWS Cloudfront's content delivery network.

tip

If your organization requires that agent traffic stays entirely on the AWS private network, Dagster+ supports AWS PrivateLink as an alternative to IP allowlisting. To enable AWS PrivateLink, contact the Dagster team to enable it. For details, see the Hybrid architecture security overview.

IP addresses​

The Dagster+ agent interacts with the following IP addresses:

34.215.239.157
35.165.239.109
35.83.161.124
44.236.154.129
44.236.31.202
44.239.93.251
54.185.29.42
54.188.126.120
note

Additional IP addresses may be added over time. This list was last updated on December 17, 2025.

URLs​

In addition to these IP addresses, the following URLs also need to be allowed egress access from your agent:

  • cloud-prod-object-snapshots.s3.amazonaws.com and cloud-prod-object-snapshots.s3.us-west-2.amazonaws.com
  • cloud-prod-compute-logs.s3.amazonaws.com and cloud-prod-compute-logs.s3.us-west-2.amazonaws.com *
  • <organization-name>.agent.dagster.cloud

* Only required if compute logs are being sent to Dagster+'s control plane. Not needed if you've configured compute logs to be sent to your own blob storage. See Managing compute logs and error messages for more details.

note

By default, the S3 URLs that Dagster+ generates for your agent use the legacy global S3 hostname (for example, cloud-prod-object-snapshots.s3.amazonaws.com). If your network requires regional S3 hostnames (for example, cloud-prod-object-snapshots.s3.us-west-2.amazonaws.com), such as when routing S3 traffic through an AWS PrivateLink interface endpoint for S3 that doesn't support legacy global endpoints, contact the Dagster team to have your organization switched to regional-style URLs. If you allowlist hostnames, we recommend allowlisting both forms.