Creating an Allow List of Webhook Server IP Addresses

Because the Webhooks v3 cloud-based infrastructure runs on Amazon Web Services, there’s no simple way of creating an allow list of server IP addresses: after all, individual servers can come and go at any time, and IP addresses can appear and reappear seemingly at random. To be on the safe side, you’d have to place the entire range of IP addresses allocated to the Akamai Identity Cloud on the allow list.

If you’re concerned about verifying the validly of event notifications, a better approach might be to verify the signature on each notification: if the signature is valid then the notification is valid.