Security teams commonly have questions about running Cloud Observability as part of their production environment. This document summarizes how you can categorize and evaluate Cloud Observability from a security perspective.
The Microsatellites and OpenTelemetry Collectors are plain binaries that only process the data explicitly sent to it by the tracers in your instrumentation. The Microsatellite or Collector does not automatically inspect, acquire, or otherwise gather data from the host environment. As such, you have complete control over what data is accessible.
To enforce this restriction, you can further isolate the binary in the host environment using dedicated VMs, firewalls, containers, or other standard mechanisms of your choosing which would apply to any binaries running in your production environment to ensure they receive and send only the intended traffic via the configured ports. In a standard Cloud Observability configuration, limit all outbound connections to only the following IP addresses on TCP ports 443
and 8043
.
34.16.60.193
34.27.88.67
34.29.53.55
34.30.37.57
34.30.123.57
34.30.133.12
34.31.3.83
34.41.77.131
34.41.164.89
34.42.36.52
34.66.189.145
34.69.214.234
34.70.236.16
34.72.38.2
34.72.191.132
34.121.148.193
34.123.51.12
34.123.140.38
34.132.246.60
34.136.162.208
34.136.223.49
34.172.64.2
34.172.208.23
34.172.225.65
35.184.41.47
35.184.162.81
35.184.220.235
35.224.106.141
35.238.95.39
35.193.91.225
35.194.17.25
35.222.235.148
35.226.22.138
35.232.132.71
104.154.103.101
130.211.193.119
35.246.192.108
34.159.124.27
35.246.222.167
34.159.92.86
34.107.110.167
34.159.197.43
35.242.238.144
34.159.52.219
By extension, the platform only has access to the data sent to it by the Microsatellites or OpenTelemetry Collectors. Our best practices, guidelines, assurances, and remediation strategies around the data sent to the platform are documented elsewhere in our contracts and legal documentation. Please review that documentation to ensure only the data you want is accessible to Cloud Observability. In short, you control the specific data sent to Cloud Observability and should avoid sending any sensitive data to the Microsatellite or Collector that shouldn’t be sent to the platform.
Both the Microsatellites and the platform are composed of proprietary code. Internally, Cloud Observability follows best practices including, but not limited to, source code control, code review, and continuous testing to ensure the reliability of these service components.
OpenTelemetry Collector code is fully open-source and follows security best practices including source code control, code review, and automated testing.
The webhook notification destinations send POST requests with JSON payloads over HTTP/HTTPS. Your inbound allow list should be include the following IP addresses:
34.123.126.19
34.121.204.203
34.171.54.190
35.224.11.174
35.223.146.183
34.70.179.4
34.135.4.97
35.184.153.167
34.171.48.174
34.67.61.111
35.222.105.79
34.67.77.29
34.136.114.102
34.122.229.184
34.67.205.228
34.121.150.92
34.67.95.231
34.121.71.244
108.59.83.75
35.188.95.176
104.198.218.164
34.172.78.188
34.170.67.62
34.121.173.78
35.239.178.13
34.123.84.214
34.171.211.174
35.223.240.94
34.136.190.181
34.135.130.105
35.194.45.45
35.222.219.106
34.31.246.121
34.31.252.177
35.194.44.251
34.30.127.44
35.224.255.71
34.41.86.245
35.238.115.55
34.123.175.87
34.72.176.229
35.192.92.241
34.173.171.176
34.28.208.126
34.30.224.240
34.69.186.65
34.42.94.101
34.136.146.157
35.223.37.249
34.68.89.198
The Cloud Observability OpenTelemetry launchers OpenTracing tracers send data from the host application to the Microsatellites. They are all open source and hosted on GitHub. Security teams are encouraged to audit them for specific concerns.
The launchers and tracers transfer data using explicit API calls which gives you full control over the data communicated to Cloud Observability.
Cloud Observability uses the American Institute of Certified Public Accountants (AICPA) SOC 2 standard for measuring the security, confidentiality, and availability of our services. Our SOC 2 Type 2 report describes how we protect our customers’ data using technical and organizational controls to manage risk and oversee day-to-day operations.
Cloud Observability is compliant with the General Data Protection Regulation (GDPR). Our products, processes, and procedures meet obligations as a data processor. You can find our subprocessors here.
For more information, contact Customer Success.
Updated May 3, 2024