Authorize Access to Data Published to Tableau Cloud

The information in this topic applies to you if you publish workbooks or data sources to Tableau Cloud that contain live connections to cloud data—for example, Amazon, Google, Salesforce.com.

As a security measure, cloud-based data providers might require you to supply authorized IP addresses from which external applications request access to your data. A request from an IP address that is not explicitly approved could be rejected. To ensure live connections you publish to Tableau Cloud remain uninterrupted, add Tableau Cloud to your data provider’s allowlist.

The table below lists Hyperforce(Link opens in a new window) IP addresses Tableau Cloud uses based on the pod your site resides on. You can see the pod in the URL that appears after you sign in to Tableau Cloud.

The table below lists IP addresses for each pod. It also lists Hyperforce VPCE IDs to use when your Tableau Cloud data resides in the same region as your Tableau Cloud instance. You can see the pod in the URL that appears after you sign in to Tableau Cloud.

Notes:

  • In addition to enabling communication over the Tableau Cloud IP range, you might need to enable access over the appropriate database port (for example, 80 or 443) depending on the communication type (HTTP or HTTPS).

  • IP addresses are dedicated to and controlled by Salesforce.

IP addresses for Tableau Cloud

Hyperforce IP addresses are added periodically and will require your data provider's allowlist to be updated. Site admins will receive an email notification alerting them when new IP addresses become available.

You can also stay informed of new IP addresses using one or both options:

  • Option 1—periodically review the IP address table below: At least 30 days before the IP addresses are enabled, the IP address table below is updated.

  • Option 2—automate IP address updates using the JSON text file: Salesforce recommends that your data provider’s allowlist mirror the https://ip-ranges.salesforce.com/ip-ranges.json(Link opens in a new window) text file at all times by automating the IP address updates. New IP addresses are added to the text file at least 30 days before they’re enabled.

    In the text file, the IP address for your pod are listed by the Hyperforce region that your pod resides in. To determine the Hyperforce region, refer to the "Pod" and the associated "Hyperforce Region" columns in the table below. For example, if your pod name is "prod-ca-a", your Hyperforce region is "ca-central-1". In https://ip-ranges.salesforce.com/ip-ranges.json(Link opens in a new window) text file, search for "ca-central-1" for the appropriate IP address to include in your data provider's allowlist.

    Notes:

    • When new IP addresses become available, a new version of the text file that contains both new and existing IP addresses replaces the previous text file.
    • The text file version is indicated by the “createDate” (in UTC).
    • Salesforce recommends that you make a copy of the previous version of the text file for your records.
    • Not all regions will receive new IP addresses at the same time.

IP addresses

Location Hyperforce Region Pod (Pod Name) IP Address and Range after Hyperforce Migration

(Alternatively, search for the Hyperforce region in https://ip-ranges.salesforce.com/ip-ranges.json(Link opens in a new window))

Asia Pacific

Australia

ap-southeast-2

prod-apsoutheast-a

141.163.192.0/23

Indonesia

ap-southeast-3

prod-apsoutheast-c

141.163.212.0/24

Japan

ap-northeast-1

prod-apnortheast-a

141.163.208.0/23

Singapore

ap-southeast-1

prod-apsoutheast-b

141.163.196.0/23

Canada

Quebec

ca-central-1

prod-ca-a

155.226.152.0/23

Europe Germany eu-central-1

dub01 (DUB01)

145.224.208.0/23

eu-west-1a (EW1A)

UK

eu-west-2

prod-uk-a

145.224.200.0/23

United States - West Oregon us-west-2

10ax (10AX)

155.226.128.0/21

10ay (10AY)

10az (10AZ)

uw2b (UW2B)

prod-uswest-c

United States - East Virginia us-east-1

prod-useast-a

155.226.144.0/22

prod-useast-b

us-east-1 (useast-1)

prod-useast-c

About the Hyperforce migration

Between August 2024 and March 2025, Tableau Cloud sites were migrated to Salesforce's Hyperforce(Link opens in a new window). This move enhances broader compliance, improves security and privacy, increases regional availability, and ensures future scalability, delivering these benefits more quickly and reliably worldwide.

Previous IP addresses

The migration to Hyperforce resulted in a change to Tableau Cloud IP addresses. The old IP addresses are provided below for reference and to assist you in identifying and removing any inactive IP addresses from your data provider's allowlist.

For active IP addresses, see the table above.

IP addresses before Hyperforce migration
Location Hyperforce Region Pod (Pod Name) IP Address before Hyperforce Migration
Asia Pacific

Australia

ap-southeast-2

prod-apsoutheast-a

3.25.37.32/28

Japan

ap-northeast-1

prod-apnortheast-a

18.176.203.96/28

Canada

Quebec

ca-central-1

prod-ca-a

3.98.24.208/28

Europe

Germany

Note: Formerly Ireland region prior to the Hyperforce migration.

eu-central-1

dub01 (DUB01)

34.246.74.86

52.215.158.213

eu-west-1a (EW1A)

34.246.62.141

34.246.62.203

UK

eu-west-2

prod-uk-a

18.134.84.240/28

United States - West Oregon us-west-2

10ax (10AX)

34.208.207.197

52.39.159.250

10ay (10AY)

34.218.129.202

52.40.235.24

10az (10AZ)

34.218.83.207

52.37.252.60

us-west-2b (UW2B)

34.214.85.34

34.214.85.244

United States - East Virginia us-east-1

prod-useast-a

3.219.176.16/28

prod-useast-b

3.219.176.16/28

us-east-1 (useast-1)

50.17.26.34

52.206.162.101

VPCE IDs for Tableau Cloud

After the migration to Hyperforce, some new requirements apply when accessing Tableau Cloud data stored in an Amazon S3 bucket.

When the data is in the same region as your Tableau Cloud instance:

  • You must use a VPC endpoint (VPCE) instead of IP source addresses to control access to your S3 data.

    VPC endpoints are private connections between a virtual private cloud (VPC) and a resource (your data in S3). Using an endpoint is a better solution because an IP address can change over time.

When the S3 bucket is in a different region than the Tableau Cloud site:

  • You need to use the IP addresses to control access to the S3 bucket.

This applies to both the S3 connector and the Snowflake connector when the Snowflake instance is on AWS in the same region as the Pod and Internal stage protection is enabled(Link opens in a new window) in the Snowflake instance.

IP addresses and VPCE IDs

Location Hyperforce Region Pod (Pod Name) IP Address and Range / VPCE ID
Asia Pacific

Australia

ap-southeast-2

prod-apsoutheast-a

141.163.192.0/23

vpce-071ca855ea8cc1154

Indonesia

ap-southeast-3

prod-apsoutheast-c

141.163.212.0/24

vpce-05825e2ebed977018

Japan

ap-northeast-1

prod-apnortheast-a

141.163.208.0/23

vpce-045516807606e4738

Singapore

ap-southeast-1

prod-apsoutheast-b

141.163.196.0/23

vpce-0c47ba2622417575b

Canada

Quebec

ca-central-1

prod-ca-a

155.226.152.0/23

vpce-0fd4bd6f2f928fcf7

Europe Germany eu-central-1

dub01 (DUB01)

145.224.208.0/23

vpce-091ff41bc3686e6e8

eu-west-1a (EW1A)

UK

eu-west-2

prod-uk-a

145.224.200.0/23

vpce-0101caa470966f49d

United States - West Oregon us-west-2

10ax (10AX)

155.226.128.0/21

vpce-090a7c76e361d5013

10ay (10AY)

10az (10AZ)

uw2b (UW2B)

prod-uswest-c

United States - East Virginia us-east-1

prod-useast-a

155.226.144.0/22

vpce-0ea40e596e16259d1

prod-useast-b

us-east-1 (useast-1)

prod-useast-c

Tableau Bridge connections to Tableau Cloud

To facilitate connections between on-premises data and Tableau Cloud, Tableau Bridge uses common port 443 to make outbound requests to Tableau Cloud. For more information, see Network access section in the Install Tableau Bridge topic.

See also

Keep Data Fresh(Link opens in a new window) (Tableau Cloud Help)

 

Thanks for your feedback!Your feedback has been successfully submitted. Thank you!