Introduction

This article provides essential network configuration information for IT administrators and network security teams. To ensure seamless access and full functionality of Docebo from within your corporate network, certain outbound connections to Amazon Web Services (AWS) infrastructure must be permitted through your firewall or web proxy.

Docebo leverages robust and globally distributed AWS services to deliver content efficiently and enable specific features. As such, you may need to explicitly allowlist the necessary endpoints or IP address ranges within your corporate network security policies. Failure to allow traffic to these required services can result in users experiencing connection issues, slow performance, or inability to use certain features of Docebo.

External services requiring access

Our platform primarily relies on two key AWS services that may require allowlisting:

• AWS CloudFront (Content Delivery Network or CDN): We use AWS CloudFront to distribute application content globally, ensuring fast and reliable access for users regardless of their location.
  These hostnames resolve dynamically to the most optimal AWS CloudFront edge server pools based on the user's location. Ideally, your firewall or proxy rules should be configured to trust these DNS names. However, we understand that some security policies mandate the use of IP address ranges instead of hostnames. For such cases, searching for CLOUDFRONT within this JSON file (opens in new tab) provides guidance on obtaining the current AWS IP ranges for the CloudFront service.
• AWS S3 (Simple Storage Service): Specific functionalities within Docebo, such as the direct upload of certain assets (like CSV files for data import), utilize a specific AWS S3 endpoint. You can refer to the AWS documentation (opens in new tab) for the up-to-date endpoints. However, we understand that some security policies mandate the use of IP address ranges instead of hostnames. For such cases, searching for S3 within this JSON file (opens in new tab) provides guidance on obtaining the current AWS IP ranges for the CloudFront service.

Allowing connections to and from Docebo

Specific integrations and applications necessitate that your Docebo platform initiates connections to services hosted within your network or other designated external endpoints. The following tables supply the necessary networking information from the Docebo cloud infrastructure to enable these connections securely.

By default, corporate firewalls are typically configured to block unsolicited incoming connections. Therefore, to allow these legitimate connections initiated by Docebo for the features listed above, you must explicitly configure your firewall rules to permit traffic originating from specific Docebo IP addresses.

Please note: All IP addresses are potentially subject to change. Docebo will, whenever possible, pre-communicate changes within a timely manner.

Learning platforms

Europe

Canada

USA

Asia Pacific

Sandbox platforms

Europe

Canada

USA

Asia Pacific