Static IPs (Egress)

Usually, when your Launch server app talks to other services, its address keeps changing. This makes it hard for those services to recognize your app. Static IPs fix this by giving your app a single, permanent address for all its outgoing requests.

Static IPs give your Launch application a fixed set of outbound IP addresses. You add those addresses to the allowlist on your backend systems, such as databases and internal or third-party APIs, so they can recognize and authorize traffic that comes from your application.

Note Static IPs are currently available for Launch on AWS.

• When Static IPs are, and are not, the right fit.

• How Static IPs route outbound traffic through a fixed set of addresses.

• How Static IPs compare to Private Network Deployments.

• How to enable, allowlist, and test Static IPs.

• Your database only accepts connections from an approved list of IP addresses.
• You call APIs that check the source IP before allowing a request, such as payment providers, authentication providers, or internal company APIs.
• You connect to services that sit behind a firewall and authorize traffic by IP.

• You need traffic to reach your backend over a private path that never touches the public internet, or you need to be fully isolated from other organizations. Use Private Network Deployments for that.
• You need IP addresses that belong only to your organization. Static IPs are shared with a small group of other customers, as explained below.
• You need a fixed public address that external clients connect to. Static IPs only cover outbound traffic.

When the Static IPs feature is enabled for your organization:

• Your application's runtime servers run inside a Launch-managed AWS network that is shared with a small group of other Static IPs customers. Launch keeps each customer separate from the others at the subnet level.
• Every outbound request from your application leaves through this network's NAT gateway, which uses a fixed set of IP addresses. Those are your static IPs.
• The addresses stay the same when you deploy new versions of your application, so you can allowlist them once and rely on them.
• Traffic to your backend still travels over the public internet, but it now comes from a source you can allowlist.
• Static IPs only work for outbound or egress requests sent from your Launch server app to other services.

Note Only your runtime servers use the static IPs. Traffic from the build process and Launch edge functions does not, so any calls they make to a backend come from a different address.

Launch gives you two ways to manage how your application reaches your backend. Static IPs is the simpler option, and Private Network Deployments is the dedicated one. Here is how they compare.

Feature	Static IPs	Private Network Deployments
IP addresses	Fixed outbound IPs in a shared network	Fixed outbound IPs in a dedicated network
Isolation	Shared with a small group of customers, separated at the subnet level	A dedicated network for your organization only
VPC peering	Not available	Available, for a private path into your AWS VPC
Common uses	IP allowlisting, database and API access	IP allowlisting, VPC peering, full isolation, compliance
Pricing	Lower than Private Network Deployments	Higher than Static IPs

Note If your organization has both Static IPs and Private Network Deployments turned on, Private Network Deployments takes priority.

The Launch team handles setup, and you do not need to configure anything on each deployment.

1. Contact your account manager or Contentstack Support to turn on Static IPs for your organization.
2. Once it is enabled, Launch sends you the set of static IP addresses assigned to your application.
3. Add those addresses to the allowlist on every backend your application needs to reach. This is usually a firewall rule, a security group, or an IP allowlist.
4. Deploy the way you normally do. Your outbound requests now come from the static IPs.

After the Static IPs feature is enabled and you have added the addresses to your allowlist, you can confirm everything works with a small Launch cloud function. The function below does two things: it calls one of your allowlisted backends, and it reports the public IP address from which your traffic leaves.

1. Deploy the following as a Launch cloud function, replacing the backend URL with an allowlisted endpoint, such as a health-check endpoint:
   1234567891011121314151617

   const BACKEND_URL = 'https://api.example.com/health';
     
   async function tryFetch(url) {
     try { 
      const res = await fetch(url, { signal: AbortSignal.timeout(5000) }); 
      return { ok: true, body: (await res.text()).trim() }; 
      } catch (err) { 
        return { ok: false, error: err.message }; 
      }
   }
   
   export default async function handler(request, response) {
     const backend = await tryFetch(BACKEND_URL);
     const egress = await tryFetch('https://checkip.amazonaws.com');
     
     response.status(200).json({ backend, egress });
   }

2. Invoke the function and check the JSON response:
   12345678910

   {
     "backend": {
       "ok": true,
       "body": "OK"
     },
     "egress": {
       "ok": true,
       "body": "203.0.113.10"
     }
   }

   Verify two things:

   • The egress value matches one of the static IP addresses Contentstack provided.
   • The backend call succeeds—ok is true and a body is returned.

   If the backend call fails, confirm every static IP address has been added to that backend's allowlist.

Launch sets Static IPs at the organization level, so they apply to all of your projects and every environment within them. You cannot limit them to a single project or a single environment.

The Static IPs feature is available as an add-on. To turn it on for your organization, contact your account manager or Contentstack Support. They confirm pricing and send you the static IP addresses to allowlist.