Cloud Provider IP Blocking¶

TornadoAPI Guard can automatically detect and block requests from major cloud providers. The IP ranges for these providers are only loaded when cloud blocking is enabled, improving startup performance.

Supported Providers¶

Currently supported cloud providers:

Amazon Web Services (AWS)
Google Cloud Platform (GCP)
Microsoft Azure

Basic Configuration¶

Enable cloud provider IP blocking:

config = SecurityConfig(
    block_cloud_providers={"AWS", "GCP", "Azure"}
)

Selective Blocking¶

Block specific providers:

config = SecurityConfig(
    block_cloud_providers={"AWS"}  # Only block AWS IPs
)

IP Range Updates¶

Cloud IP ranges are refreshed automatically at a configurable interval (default: 1 hour). You can adjust the refresh interval:

config = SecurityConfig(
    block_cloud_providers={"AWS", "GCP", "Azure"},
    cloud_ip_refresh_interval=1800,  # Refresh every 30 minutes
)

Valid range: 60 to 86400 seconds (1 minute to 24 hours).

When IP ranges are refreshed, changes are logged automatically:

Cloud IP range update for AWS: +12 added, -3 removed

You can also manually trigger a refresh:

from tornadoapi_guard import cloud_handler

cloud_handler.refresh()

Provider Status¶

Track when each provider's IP ranges were last refreshed:

from tornadoapi_guard import cloud_handler

for provider in ("AWS", "GCP", "Azure"):
    updated = cloud_handler.last_updated[provider]
    if updated:
        print(f"{provider}: last updated {updated.isoformat()}")
    else:
        print(f"{provider}: not yet loaded")

Custom IP Checking¶

Check if an IP belongs to a cloud provider:

from tornadoapi_guard import SecurityHandler, cloud_handler


class CheckCloudHandler(SecurityHandler):
    async def get(self, ip: str) -> None:
        is_cloud = cloud_handler.is_cloud_ip(
            ip,
            providers={"AWS", "GCP", "Azure"},
        )
        self.write({"ip": ip, "is_cloud": is_cloud})

Register as (r"/check-cloud/([^/]+)", CheckCloudHandler) in your tornado.web.Application.