Tealium IP addresses to allow

We are adding IP addresses to all of our data processing regions to maintain seamless operations with increased server-side traffic. If the new IP addresses are not added to your current allowlist before the roll-out date, you may notice increased connector errors, function action errors, and files not being read from S3 file services outside of Tealium.

Additional IP addresses

If you are using allowlists (also known as safelists or whitelists), include the new IP addresses to continue operating without increased error rates.

The additional IP addresses will be introduced on the following dates:

• Apr 29, 2024 - US (Oregon)
• May 6, 2024 - EU (Ireland and Frankfurt)
• May 13, 2024 - APJ (Hong Kong, Sydney, Tokyo)
• May 20, 2024 - US (US East 1)

After the change, you can check the following three indicators to test if you are being impacted due to missing IP addresses from your allowlist in your firewall configuration:

• Increased connector or function action errors as seen in the Tealium UI (error message will depend on the third-party vendor).
• Reduced traffic from Tealium to your vendor endpoints.
• File import files are no longer getting processed (Tealium is being blocked from pulling files from your non-AWS S3 file service location).

This change will not impact customers who use IP allowlists as an additional security measure to control user login access to the Tealium platform. The scope is limited to traffic flowing through Tealium’s platform and does not include our UI.

How it works

The CDH communicates with external systems during the following operations:

• Sending data to external systems with connector actions.
• Performing custom actions in functions.
• Retrieving files from File Import data sources, except AWS S3.

If an external system restricts access to only an approved list of IP addresses, then add all of the following IP addresses to your allowlist:

* Original IP address list

OAuth calls, test connections, and File Import data source test connections (except AWS S3) use the US-West-1 region. Only login information passes through OAuth calls and test connections, not client data.

AWS S3

Tealium File Import can retrieve files from either the included Tealium S3 bucket or your S3 bucket. If you want to retrieve files from your company’s own S3 bucket (not the included Tealium S3 bucket), the AWS bucket policy allowlist must include the VPCe IDs (VPC endpoint IDs) below and the above IP addresses.

For more information about AWS bucket policies, see the following articles in the AWS documentation:

• Adding a bucket policy by using the Amazon S3 console
• Controlling access from VPC endpoints with bucket policies