How can I allowlist IP addresses for a deployment?

With Vercel Secure Compute, you can establish private connections between Serverless Functions and backend clouds such as databases and private infrastructure. This guide will provide you with steps to allowlist IP addresses for a deployment.

Overview

When using Vercel, by default, you have to expose your backend cloud to all IP addresses to allow your deployment to connect. However, such an approach might not align with strict security and compliance rules. This is where Secure Compute comes in. When enabled, it places your deployments in a private network with dedicated IP addresses.

Working with Secure Compute

To enable Vercel Secure Compute for a project:

1. Vercel positions your project's build container and deployment in a private network.
2. This network will have a specific dedicated IP address pair.
3. You can optionally exclude the build container from this private network.

Dedicated IP Addresses

• Secure Compute provides private networks with automatically assigned IP pairs, accessible through the Vercel Dashboard.
• On requesting access, Vercel creates one private network in a chosen Serverless Function region.
• Multiple private networks can be created within the same team by making requests through the Dashboard.
• The Secure Compute feature affects Serverless Functions only. Edge Functions do not utilize these dedicated IPs.

Region Selection

Each private network is deployed within a specific Serverless Function region. We recommend to pick a region for the private network that aligns with the location of your backend cloud to ensure optimal performance.

Securing Your Backend

After obtaining your dedicated IP pair:

1. Utilize the IP pair to set up an access control list for your backend infrastructure.
2. Besides IP-based authentication, ensure the use of additional authentication methods like user/password or an authentication key.

Configuring Secure Compute

Within a team:

1. Connect a private network with the environment of your Project's deployment, i.e., Serverless Functions and Incremental Static Regeneration (ISR).
2. A single private network can be used across multiple projects, sharing the same IP pair.
3. For heightened security or larger teams, assign one private network to each project. This way, every project has a unique dedicated IP pair.
4. If deploying Serverless Functions in multiple regions, use multiple private networks, ensuring distinct IP pairs per region.
5. Allocate various IPs to different types of projects for enhanced security and management.

Need VPC or VPN Support?

For those with rigorous security and compliance requirements, Vercel can provide guidance tailored to specific needs. Reach out if dedicated IP addresses aren't sufficient for your case.

Conclusion

Leveraging Vercel Secure Compute ensures enhanced privacy and security for your Vercel deployments. It allows you to maintain a private connection between your Serverless Functions and backend infrastructure, significantly reducing potential risks.