Looker-hosted instances — Many companies prefer to use a Looker-hosted instance for the simplicity, ease of implementation, and reduced support costs. In this case, the data that passes between Looker and the database travels over the public Internet, on shared infrastructure. Consequently, it is important to ensure data security. Use one of the options on this page to ensure that your network can connect securely to your Looker-hosted instance.
Customer-hosted instances — Customers who are hosting their own Looker instance may be on the same private network as their database. However, if that is not the case, be sure to secure your data as well, perhaps using the types of options suggested on this page. For an IP address allowlist, add to the allowlist the IP address or addresses where your Looker instance is hosted.
These are the options for enabling secure database access for your instance, from simplest to most complex:
See the following sections for details.
Option 1: IP address allowlist
The first step is to limit access to your data from the network layer. We recommend granting access to your database only from specific, trusted hosts.
The list of IP addresses that are needed to allow network traffic from your Looker instance can be found on the Connections page in the Admin panel. Click Public IP Addresses and copy the IP address(es) that are shown.
All network traffic from Looker will come from one of the listed IP addresses, depending on the region where your Looker instance is hosted. Prohibiting traffic to your database, except from these and other trusted IP addresses, is an easy way to limit data access.
These allowlist IP addresses also apply to SFTP and SMTP destinations and for LDAP servers that restrict IP traffic. If you are using custom mail settings for SMTP, be sure to add Looker’s IP addresses to your SMTP server’s IP allowlist. Also, if you want to deliver content from Looker to an SFTP server, be sure to add Looker’s IP addresses to your SFTP server’s IP allowlist or inbound traffic rules. If your LDAP server restricts IP traffic, you will need to add Looker’s IP addresses to your LDAP server’s IP allowlist or inbound traffic rules.
The complete list of IP addresses for all Looker-hosted envrionments can be found on this page.
You do not need to add all the IP addresses for your region to your allowlist. For the most accurate and condensed list, please refer to the Public IP Addresses button shown in the Connections page in the Admin panel.
Legacy hosting
Use these IP addresses for all instances that are hosted on AWS and that were created before 07/07/2020.
Click here for a full list of IP addresses for legacy hosting keyboard_arrow_right
United States (AWS default)
54.208.10.16754.209.116.19152.1.5.22852.1.157.15654.83.113.5
Canada
99.79.117.12735.182.216.56
Asia
52.68.85.4052.68.108.109
Ireland
52.16.163.15152.16.174.170
Germany
18.196.243.9418.184.246.171
Australia
52.65.128.17052.65.124.87
South America
Next-generation hosting
Use these IP addresses for all instances that are hosted on Google Cloud Platform (GCP) and all instances that are hosted on Amazon Elastic Kubernetes Service (Amazon EKS) and that were created on or after 07/07/2020.
Click here for a full list of IP addresses for next-generation hostingkeyboard_arrow_right
Instances hosted on Google Cloud Platform (GCP)
Looker-hosted instances are hosted on GCP by default. For instances that are hosted on GCP, add to the allowlist the IP addresses that match your region.
Moncks Corner, South Carolina, USA (us-east1)
34.75.58.12335.196.30.11035.243.254.16634.111.239.10235.237.174.1734.73.200.23535.237.168.216
Ashburn, Northern Virginia, USA (us-east4)
35.221.30.17735.245.82.7335.194.74.18535.245.177.11234.86.118.23934.86.52.18835.221.3.16335.245.211.10934.86.136.19034.86.214.22635.221.62.21834.86.34.13535.236.240.16834.150.212.934.150.174.5434.85.200.217
Council Bluffs, Iowa, USA (us-central1)
34.69.207.17634.70.128.7435.239.118.197104.154.21.23135.192.130.12635.184.100.51
The Dalles, Oregon, USA (us-west1)
34.82.120.2535.247.5.9935.197.64.5735.233.172.2335.233.249.16035.247.55.3335.247.117.035.247.61.15134.82.193.21535.233.222.22634.83.94.15135.203.184.4834.83.138.10535.197.35.18834.127.116.8534.145.90.8334.127.41.19934.82.57.22535.197.66.244
Montréal, Québec, Canada (northamerica-northeast1)
35.234.253.103- 35.203.46.255`
34.152.60.210
London, England, UK (europe-west2)
35.189.94.10535.246.36.6735.234.140.7734.142.77.1834.105.131.13334.89.54.8434.89.124.13934.89.25.534.105.209.4434.105.181.13335.242.138.13334.105.219.15434.89.127.5135.246.10.20635.189.111.17335.197.222.22034.105.198.15135.246.117.5834.142.123.96
Frankfurt, Germany (europe-west3)
34.159.224.18734.159.10.5934.159.72.7735.242.243.25534.159.247.21135.198.128.126
Mumbai, India (asia-south1)
34.93.221.13735.244.24.19835.244.52.179
Eemshaven, Netherlands (europe-west4)
35.204.118.2835.204.216.734.90.52.191
Changhua County, Taiwan (asia-east1)
104.199.206.20934.80.173.21235.185.137.114
Tokyo, Japan (asia-northeast1)
35.221.107.21134.85.3.19834.146.68.20334.84.4.218
Jurong West, Singapore (asia-southeast1)
34.143.210.11634.143.132.20634.87.134.202
Jakarta, Indonesia (asia-southeast2)
34.101.158.8834.101.157.23834.101.184.52
Sydney, Australia (australia-southeast1)
34.87.195.3634.116.85.14034.151.78.48
Osasco (São Paulo), Brazil (southamerica-east1)
34.151.199.20135.199.122.1934.95.180.122
Instances hosted on Amazon Elastic Kubernetes Service (Amazon EKS)
For instances that are hosted on Amazon EKS, add to the allowlist the IP addresses that match your region.
US East (N. Virginia) (us-east-1)
52.44.90.20154.87.86.11354.162.193.16534.235.77.1173.233.169.6354.159.42.1443.229.81.10134.225.255.22034.200.121.563.83.72.4154.197.142.23834.239.90.16934.236.92.873.220.81.24152.44.187.2223.22.133.20618.213.96.4035.168.173.23854.162.175.24454.80.5.1734.200.64.24354.157.231.7618.206.32.25452.7.255.5454.196.92.552.204.125.24452.203.92.11452.3.47.189184.73.10.8552.55.10.2363.230.52.22054.211.95.15052.86.109.6854.159.176.19952.55.239.16675.101.147.9754.92.246.22318.235.225.16354.204.171.25318.210.137.13050.17.192.8718.208.86.29
US East (Ohio) (us-east-2)
3.135.171.2918.188.208.2313.143.85.223
US West (Oregon) (us-west-2)
44.237.129.3254.184.191.25035.81.99.30
Canada (Central) (ca-central-1)
52.60.157.6135.182.169.2552.60.59.12835.182.207.12815.222.172.643.97.27.5135.183.191.13315.222.86.12352.60.52.14
Europe (Ireland) (eu-west-1)
54.74.243.24654.195.216.9554.170.208.6752.49.220.10352.31.69.11734.243.112.7652.210.85.11052.30.198.16334.249.159.11252.19.248.17654.220.245.17154.247.22.227176.34.116.19754.155.205.15952.16.81.139
Europe (Frankfurt) (eu-central-1)
18.157.231.10818.157.207.3318.157.64.19818.198.116.1333.121.148.1783.126.54.15418.193.187.10018.196.108.8618.198.157.149
Asia Pacific (Tokyo) (ap-northeast-1)
54.250.91.5713.112.30.11054.92.76.241
Asia Pacific (Sydney) (ap-southeast-2)
13.238.132.1743.105.238.713.105.113.36
South America (São Paulo) (sa-east-1)
54.232.58.18154.232.58.98177.71.134.208
Instances hosted on Microsoft Azure
For instances that are hosted on Azure, add to the allowlist the IP addresses that match your region.
Virginia, USA (us-east2)
Option 2: SSL encryption
A second option is to enable SSL encryption on your database. SSL prevents anyone from being able to intercept the data between Looker and your database.
You’ll first need to complete the IP address allowlist instructions in the Option 1: IP address allowlist section on this page. Further instructions for SSL encryption are dialect specific; for links to SSL instructions, see the Database configuration instructions section on the Looker dialects documentation page.
Option 3: SSH tunnel
The third option you can use to protect your data is an SSH tunnel. Using a tunnel provides an encrypted connection and extra authentication for enhanced security. Instructions for this option are provided on the Using an SSH tunnel documentation page.
Next steps
After you have enabled secure database access, you’re ready to configure your database for Looker.
