Use static egress when a Destination, firewall, or API will accept Cribl.Cloud traffic only from a known source IP. By default, Cribl.Cloud uses public egress, and those outbound addresses can change when Cribl rescales infrastructure. Static egress keeps the outbound traffic in a region on a stable set of IPs that you can add to an allowlist once.

Typical cases, when Cribl.Cloud makes the outbound connection:

• A SaaS Destination such as Splunk Cloud that requires an IP allowlist and does not accept FQDN-based rules.
• An on-prem firewall or security group that can allow only specific source addresses.
• A self-hosted HashiCorp Vault server whose allowlist must include the Cribl.Cloud Leader. See Self-Hosted HashiCorp Vault and IP Allowlists.

Static egress still sends traffic over the public internet. If the Destination can use a private path, you might prefer to use Private Link instead. You should enable static egress per region only where you need a stable source IP.

Enable or Disable Static Egress ​

You can configure static egress in the Cribl.Cloud portal. You need the Admin or Owner Permission on the Workspace.

1. In the sidebar, select Workspace, then Connections.
2. Select the Static Egress IP tab.
3. Select one or more regions that share the same Status. You can’t enable and disable regions in the same action.
4. Select Enable Static Egress IP or Disable Static Egress IP.
5. Review the region list in the confirmation dialog, then select Enable or Disable.

When you enable or disable static egress, you can’t access the Workspace UI for approximately 15 minutes. Data will continue to flow through the Workspace during that window.

After you enable a region, the Status changes to Enabled before addresses appear. Wait until the Static Egress IP column lists IP addresses, then copy every address into your Destination or firewall allowlist. Do not allowlist the region while the column still shows Provisioning static IP addresses….

After you disable a region, those IPs are no longer used. Update downstream allowlists so they no longer depend on the removed addresses, or traffic to those Destinations can fail.

Static egress IPs are not the same as Leader NLB IPs on Workspace > Access. Leader NLB IPs are inbound addresses for hybrid connectivity to the Leader. Static egress IPs are outbound addresses for traffic that Cribl.Cloud sends to Destinations, Collectors, and similar pull paths.

How Static Egress Is Billed ​

Static egress consumes Cribl.Cloud credits. For each region where you enable static egress, Cribl bills two charges:

• Infrastructure (billed as Static Egress Infrastructure): An hourly rate for the dedicated NAT gateways that provide the stable IP addresses in that region. Cribl applies the rate to 24 hours for each day that the region is enabled, whether or not data flows through it.
• Data processed (billed as Static Egress Traffic): A per-GB rate for the data that passes through those gateways, in both directions. Data that Cribl.Cloud sends to a Destination counts, and so does data that comes back from Sources and Collectors, such as the responses to a REST Collector request.

Rates vary by cloud provider and region. If your Organization shows per-region pricing and you have permission to view billing information, the Static Egress IP tab lists your rates in the Credits/Hour and Credits/GB columns. In that case, the confirmation dialog for enabling regions also shows the estimated rates for your selection. For the public rates, see the Static Egress section of Cribl Pricing Plans. Your contract might include different rates, so contact your Cribl account team for contract-specific pricing.

Billing follows the regional configuration:

• Cribl checks which regions have static egress enabled once each UTC day, shortly after midnight UTC, and bills each enabled region for that day. Cribl doesn’t prorate within a day.
• If you enable static egress in a region, billing starts with the first daily check after you enable it.
• If you disable static egress in a region, billing stops with the first daily check after you disable it. The day that Cribl already counted isn’t reduced.
• Regions are billed separately. If you enable static egress in three regions, you pay the infrastructure charge and the data charge for each of those regions.

Cribl calculates data volume in binary units. Although the UI and your invoice label the unit “GB,” 1 GB equals 1 gibibyte (GiB), or 1,073,741,824 bytes. For example, 1,000,000,000 bytes bills as about 0.93 GB.

Grace Period for Existing Organizations ​

If your Organization already had static egress enabled before static egress billing began, you have a grace period. Cribl doesn’t charge you for static egress until January 1, 2027. Your Cribl Sales or Customer Success representative can confirm whether this date applies to your Organization.

View Static Egress Charges ​

Static egress charges appear on your invoice under Infrastructure, grouped by Workspace. Hours and GB are separate line items: Static Egress Infrastructure (hours) and Static Egress Traffic (GB). The line item names include the cloud provider and region, such as Static Egress Traffic @ AWS us-east-1. See Understand Your Monthly Invoice.

Static egress billing doesn’t apply to Cribl.Cloud Government (FedRAMP). The cost of static IP addresses is included in FedRAMP pricing, and Cribl doesn’t bill static egress per region there. See What’s Different in Cribl.Cloud Government.