Skip to main content
Question

IP whitelisting in PWS SaaS environment

  • July 17, 2026
  • 1 reply
  • 29 views

  • BeyondTrust Employee

Our current On prem environment has many API use cases, where we use APIs to add assets, managed systems, onboard AD groups e.t.c. using python script from AWS Lambda. And we also have many application teams retrieving managed account passwords, secret safes using APIs from a dedicated server or applications.

 

Now the issue is, in on prem environment, we usually whitelist private IPs, like IP if the servers or IP range that AWS account uses. However, in SaaS environment private IP is not working, as it is only taking public IP [Understandably expected behaviour from SaaS]. Is there any solution for this ? because public IPs is not static and we cannot keep on modifying the rules for 100s of API registrations. How are other BT customers dealing with this ?

1 reply

  • BeyondTrust Employee
  • July 20, 2026

For Password Safe Cloud, IP Allow List validation is performed against the public source IP that reaches the SaaS service. Private AWS/VPC addresses are not visible to the cloud service and therefore cannot be used for allow-listing. The recommended approach is to provide a stable public egress path (for example, an AWS NAT Gateway with Elastic IPs or a dedicated API proxy/gateway) and whitelist those static public IPs or CIDR ranges. This avoids the need to continually update IP rules for individual Lambda functions, servers, or applications.