Egress IP allowlisting
Agents run in Astro AI’s managed cloud. If your database sits behind a firewall but is reachable over the public network, you can let agents through by allowlisting Astro AI’s outbound IPs — no AWS account or infrastructure changes needed on your side.
If your database is in an AWS VPC and you don’t want any inbound public access, connect it privately over AWS PrivateLink instead — see Knowledge stores.
Get Astro AI's egress IPs
All agent workloads egress through the following static Elastic IPs. These are fixed and do not change unless a change is announced in advance:
Allowlist the IPs in your network
Add each IP to the inbound rules of whatever controls access to your database:
Use the port your database listens on. Common defaults: PostgreSQL 5432, MySQL 3306, MSSQL 1433, MongoDB 27017, Redis 6379. Check your database’s documentation if you’re unsure.
Connect the database to your agent
Once the IPs are allowlisted, connect the database as a knowledge store and bind it to your agent at deploy time — your agent receives the connection details as environment variables. See Using Knowledge stores for the full walkthrough.
Verifying the connection
The quickest check is to have your agent attempt a connection on startup and log the result before doing any real work; the exact approach depends on your database driver. If the agent starts successfully after deploy, the network path is clear. If it times out, the IPs are not yet allowlisted — double-check the firewall rules.
If the connection stays stuck after you’ve completed the steps above, reach out to support@astropods.com.