---
updatedAt: 2026-07-01T09:33:57.000Z
agentTools:
  projectIndex: https://doc.superannotate.com/llms.txt
---

# IP whitelisting

IP whitelisting is a way of giving access to your data to specific, trusted, and pre-approved IP addresses. This increases the security of your data and ensures safe remote access.

<Image src="https://files.readme.io/30ed893-ip_whitelisting.png" alt="ip whitelisting" align="center" />

Here's the list of **SuperAnnotate IPs** you may need to whitelist when using integrations (for AWS and Azure, you can read more about the process below):

> 54.204.115.30<br />100.24.156.84<br />54.83.51.100<br />34.239.194.194

Here's the list of **SuperAnnotate URLs** you may need to whitelist in case of any access difficulties:

> api.superannotate.com<br /> app.superannotate.com<br /> assets.superannotate.com<br /> assets-api.superannotate.com<br /> assets-provider.superannotate.com<br /> auth.superannotate.com<br /> cdn.superannotate.com<br /> custom-llm.superannotate.com<br /> custom-storage.superannotate.com<br /> document.superannotate.com<br /> editor.superannotate.com<br /> explore-service.superannotate.com<br /> files.superannotate.com<br /> hooks.superannotate.com<br /> item.superannotate.com<br /> llm.superannotate.com<br /> mcp.superannotate.com<br /> ml-api.superannotate.com<br /> pixel.superannotate.com<br /> public.superannotate.com<br /> public-static-files.superannotate.com<br /> telemetry.superannotate.com<br /> telemetry-scoring.superannotate.com<br /> telemetry-search-service.superannotate.com<br /> vector.superannotate.com<br /> video.superannotate.com<br /> work-management-api.superannotate.com<br /> work-metrics-api.superannotate.com<br /> zimmer.superannotate.com<br />

## AWS

### How can I restrict access to my S3 bucket by IP address?

To give access to your S3 bucket to a specific IP address, you need to create a policy for your S3 bucket or edit it if you already have one.

#### Policy example

The following policy gives access to the following IP address `54.240.143.0/24`. With this IP address, you can access the buckets stated in `Resource`. What you need to do is replace the values in `Resource` and `IpAddress` with your own values and create or edit the policy of your bucket.

```json
{
    "Version": "2012-10-17",
    "Id": "S3Allowlisting",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::DOC-EXAMPLE-BUCKET",
                "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
            ],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": ["54.240.143.0/24", "53.456.987.0/87"]
                }
            }
        }
    ]
}
```

##### Statement key

Since the `statement` key is an array, you can add multiple statements for different files and folders.

##### Condition block

The `condition` block consists of the `IpAddress` condition and the `aws:SourceIp` condition key.

The `aws:SourceIp` condition key is an AWS-wide condition key. [Learn more](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html) about condition keys.

The values of `aws:SourceIp IPv4` use the standard CIDR notation. For more information, [check out](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Conditions_IPAddress) the IAM JSON policy elements reference.

### How can I create or edit the policy of my S3 bucket?

To create or edit as S3 bucket’s policy:

1. Go to your [Amazon S3 console](https://console.aws.amazon.com/s3/).
2. Go to the bucket where you want to create a policy.
3. Select the **Permissions** tab.
4. Click **Edit** next to **Bucket policy**.
5. Add or edit the policy as explained [here](https://doc.superannotate.com/docs/ip-whitelisting#how-can-i-restrict-access-to-my-s3-bucket-by-ip-address).
6. Click **Save changes**.

## Azure

Azure offers 2 options to restrict access to Azure resources from the given range of IP addresses:

1. Put a firewall with the list of IP addresses on the Azure storage account.
2. Generate an IP-restricted SAS token on an Azure account/container/blob.

### Method 1

This method allows you to make the container’s blobs accessible only from the given range of IP addresses.

1. Go to your storage account.
2. Under **Data storage**, select **Containers**.
3. Select the container.
4. Click **Change access level**.
5. Under **Public access level**, choose **Blob (anonymous read access for blobs only)**.
6. Click **OK**.
7. Under **Security + Networking**, select **Networking**.
8. Under **Firewall**, add the IP address or the IP addresses and ranges that you want to whitelist.

Click [here](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal) for more details.

To add these Blob URLs to SuperAnnotate, use the `attach_items` function.

### Method 2

This method allows you to generate a shared access token with IP restrictions and use it in the signed URL of the given resource. You can use this method for storage accounts, containers, and blobs.

The following steps describe the setup of the container’s SAS token. You can use this method to also generate a SAS token for storage accounts and blobs.

1. Go to your container.
2. Choose **Shared access tokens** under **Settings**.
3. Under **Allowed IP addresses**, define the IP address or the IP range that are allowed to access the container.
4. Click **Generate SAS token and URL**.
5. Save the generated SAS token.

Click [here](https://docs.microsoft.com/en-us/azure/cognitive-services/translator/document-translation/create-sas-tokens?tabs=Containers) for more details.

With this method, the container blobs will be accessible from the given range of IP addresses via signed URLs.

To attach these URLs to SuperAnnotate, create a CSV file that contains these URLs and use it in the `attach_items` SDK function.

### IP whitelisting recipe

```python
from azure.storage.blob import BlobServiceClient
from azure.storage.blob import ContainerSasPermissions, generate_container_sas
from datetime import datetime, timedelta
from superannotate import SAClient
import os
 
 
azure_connection_string = "<your_connection_string>"
azure_container_name = "<your_container_name>"
authorized_ip = "<authorized_ip_or_ip_range>"
 
blob_service_client = BlobServiceClient.from_connection_string(azure_connection_string)
container_client = blob_service_client.get_container_client(azure_container_name)
 
#Generate a container SAS token with an expiry date and IP whitelisting.
sas_token = generate_container_sas(
   account_name = container_client.account_name,
   container_name = container_client.container_name,
   account_key=container_client.credential.account_key,
   permission=ContainerSasPermissions(read=True),
   expiry=datetime.utcnow() + timedelta(days=30),
   start=datetime.utcnow() - timedelta(minutes=1),
   ip = authorized_ip)
 
#Generate signed URLs on container blobs with the generated container SAS token.
attachments = []
for blob in container_client.list_blobs():
   signed_url = f"{blob_service_client.url}{container_client.container_name}/{blob.name}?{sas_token}"
   attachments.append({'name': blob.name, 'url': signed_url})
 
#Create a SuperAnnotate project and attach the generated signed URLs to it.
sdk_token = "<your_sdk_token>"
 
sa_client = SAClient(token=sdk_token)
sa_client.create_project(azure_container_name, "---", "Vector")
sa_client.attach_items(azure_container_name, attachments)
```

<br />