Jira Cloud Firewall Allowlist – Are These Domains Sufficient If We Only Use Jira?

DIDA KHARISMA AKBAR

Hello Atlassian Community,

I am reviewing the firewall allowlist requirements described in the Atlassian documentation:

IP addresses and domains for Atlassian cloud apps

Our organization only uses Jira Cloud (we are not using Confluence, Bitbucket, Trello, Opsgenie, etc.).

To minimize the number of domains that must be whitelisted on our firewall, I would like to confirm whether allowing the following domains is sufficient for Jira to function properly, including user authentication, issue management, attachments, notifications, and general UI functionality.

1. Atlassian domains

*.atl-paas.net
*.atlassian.com
*.ss-inf.net
{our-instance}.atlassian.net
*.jira.com

2. Partner domains

*.cloudfront.net
*.awswaf.com
*.cookielaw.org
*.googleapis.com

Questions

1. If we only use Jira Cloud, are the domains listed above sufficient for normal Jira operation?
2. Are there any additional domains that should be allowlisted for:
   • User authentication (Atlassian accounts / SSO)
3. Has anyone successfully implemented a minimal Jira-only firewall allowlist and can share the required domains?

Thank you for your help.

Germán Morales

@DIDA KHARISMA AKBAR  that page isn't split into per product lists, but each row in the Atlassian domains table says which product uses it. *.atl-paas.net, *.atlassian.com and *.ss-inf.net are tagged for all apps, *.jira.com is tagged Jira and Confluence, so structurally you have the right subset. One difference from the source though: the official row is the wildcard *.atlassian.net, not a single {our-instance}.atlassian.net, worth switching to the wildcard in case Jira loads anything from another *.atlassian.net subdomain beyond your own site.

Two gaps in your Partner domains section are worth adding even for a Jira only setup, since the doc doesn't tie them to any specific product:

• recaptcha.net, *.recaptcha.net, recaptcha.google.com and *.gstatic.com, used for bot checks during login
• *.gravatar.com and *.wp.com, used for generic user avatars

The rest of that table, LaunchDarkly, Segment, Sentry, Statsig, Pendo, Intercom, PubNub, Slack edge, isn't marked optional per product either. It backs feature flagging, analytics and error tracking across the UI, blocking it won't necessarily break login but I wouldn't assume it's safe to drop just because you're not running Confluence or Bitbucket.

One config detail the article calls out directly: a rule for *.atlassian.com also has to permit the bare atlassian.com, not just its subdomains, or things fail silently. And since the IP ranges behind these domains do change, last updated April 3 2025 per the doc, if your firewall can't filter by domain you'll also need the IP ranges section of that same page, plus their AWS SNS topic for update notifications rather than a static list.