# Cloud IP Range Drift Monitor (`defenestrator/cloud-ip-range-drift-monitor`) Actor

Monitor official AWS, Google, Cloudflare, GitHub, and Fastly IP range feeds for firewall allowlist and network perimeter drift.

- **URL**: https://apify.com/defenestrator/cloud-ip-range-drift-monitor.md
- **Developed by:** [Defenestrator](https://apify.com/defenestrator) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 monitor rows

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## Cloud IP Range Drift Monitor

Monitor official public IP range feeds for cloud and SaaS providers, then produce decision-ready rows for firewall allowlist, egress policy, SIEM, WAF, and vendor-risk review workflows.

This Actor is not affiliated with AWS, Google, Cloudflare, GitHub, Fastly, or Apify. It fetches fixed official public endpoints and does not probe private networks or user-supplied URLs.

### What it does

- Fetches fixed official IP range feeds for:
  - AWS `ip-ranges.json`
  - Google Cloud `cloud.json`
  - Google `goog.json`
  - Cloudflare public IP API
  - GitHub Meta API
  - Fastly public IP list
- Normalizes IPv4/IPv6 CIDR blocks into deterministic provider/service/region rows.
- Compares the current feed to a previous `OUTPUT.snapshot` when supplied.
- Emits provider summary rows plus added/removed CIDR rows.
- Optionally highlights focus services/categories and regions.
- Stores the next-run snapshot in `OUTPUT.snapshot` so scheduled/API workflows can pass it back on the next run.

### Why run it repeatedly?

Cloud and SaaS IP ranges change without matching your firewall, WAF, CDN, partner VPN, SIEM, and outbound allowlist review calendar. A scheduled run catches changes before teams discover them through broken integrations or emergency firewall tickets.

Typical repeat-use loop:

1. Run once to create a baseline snapshot.
2. Copy `OUTPUT.snapshot` into the next run's `previousSnapshot` or `previousSnapshotJson`.
3. Schedule recurring runs or call by API from a change-management workflow.
4. Review only summary and delta rows unless you explicitly ask for full current prefix rows.

### Input highlights

- `providers`: choose any of `aws`, `google-cloud`, `google`, `cloudflare`, `github`, `fastly`.
- `previousSnapshot`: previous `OUTPUT.snapshot` object for drift comparison.
- `previousSnapshotJson`: same snapshot as text, useful for API callers.
- `focusServices`: highlight categories such as `actions`, `hooks`, `CLOUDFRONT`, `AMAZON`, `cloudflare-edge`, or `fastly-edge`.
- `focusRegions`: highlight scopes such as `us-east-1`, `GLOBAL`, or `global`.
- `includeCurrentPrefixes`: push current prefix rows too. Leave false for cheap scheduled monitoring.

### Output rows

Dataset rows use these row types:

- `SUMMARY`: one row per provider, always emitted.
- `ADDED`: prefix appears in current snapshot but not the previous snapshot.
- `REMOVED`: prefix existed in the previous snapshot but not the current snapshot.
- `FOCUS_CURRENT`: current prefix matching a focus service or region.
- `CURRENT`: current prefix row when `includeCurrentPrefixes=true`.
- `ERROR`: provider fetch/parse failure row when a source fails.

`OUTPUT` includes run-level counts and `snapshot`, which is the baseline object to preserve for the next run.

### Pricing

This Actor uses Apify Pay Per Event (PPE) pricing:

- `apify-actor-start`: `$0.00005` per run start.
- `apify-default-dataset-item`: `$0.002` per dataset row (`Monitor row`).
- Platform usage is included in the event price; users do not pay a separate platform-usage pass-through.
- A dataset row is one monitored result, source, or drift-check row emitted by the Actor. Run cost scales with the number of rows produced and the limits you choose.

Use Apify's max total charge setting before starting a run if you want a hard spend cap.

### Limitations

- The Actor does not update your firewall or cloud account. It produces normalized rows and a snapshot for review/automation.
- The Actor compares against a snapshot you provide; it does not automatically read previous private runs unless your workflow passes the prior snapshot back in.
- Provider feeds can include overlapping prefixes under multiple services/categories. Rows are keyed by provider + service/category + region/scope + prefix.
- This is not a security guarantee, availability guarantee, or legal/compliance opinion. Verify critical allowlist changes against the official provider source before production changes.
- Azure Service Tags are not included in this build because the stable public JSON URL discovery path needs separate QA before inclusion.

### Responsible use

Use this for your own network operations, vendor-risk monitoring, and change-management workflows. Do not use it to infer affiliation, availability, or security posture beyond the official public feed data.

# Actor input Schema

## `providers` (type: `array`):

Provider feeds to fetch from fixed official public sources. Supported values: aws, google-cloud, google, cloudflare, github, fastly.
## `previousSnapshot` (type: `object`):

Optional snapshot object copied from a previous run's OUTPUT.snapshot. When supplied, the Actor outputs added/removed CIDR rows and provider summary alerts.
## `previousSnapshotJson` (type: `string`):

Optional JSON text version of a previous OUTPUT.snapshot. This is useful when calling the Actor by API or when the Console object editor is inconvenient.
## `focusServices` (type: `array`):

Optional case-insensitive service/category names to highlight, such as actions, hooks, CLOUDFRONT, AMAZON, cloudflare-edge, or fastly-edge.
## `focusRegions` (type: `array`):

Optional case-insensitive regions/scopes to highlight, such as us-east-1, GLOBAL, global, or asia.
## `includeCurrentPrefixes` (type: `boolean`):

If true, push current prefix rows in addition to summary and delta rows. Leave false for low-cost scheduled drift monitoring.
## `maxCurrentRows` (type: `integer`):

Cap current prefix rows per run when includeCurrentPrefixes=true. Delta rows are not capped by this setting.
## `maxProviders` (type: `integer`):

Safety cap for selected provider count.
## `requestTimeoutSecs` (type: `integer`):

Timeout for each official feed request.
## `maxSourceBytes` (type: `integer`):

Maximum bytes accepted from each official source feed. AWS can exceed 2 MB, so do not set this too low for all-provider runs.

## Actor input object example

```json
{
  "providers": [
    "cloudflare",
    "github",
    "fastly"
  ],
  "previousSnapshot": {},
  "previousSnapshotJson": "",
  "focusServices": [],
  "focusRegions": [],
  "includeCurrentPrefixes": false,
  "maxCurrentRows": 5000,
  "maxProviders": 6,
  "requestTimeoutSecs": 25,
  "maxSourceBytes": 5242880
}
````

# Actor output Schema

## `results` (type: `string`):

Provider summary rows plus added/removed/focus/current CIDR rows depending on input.

## `summary` (type: `string`):

Run-level summary, source metadata, counts, and OUTPUT.snapshot for the next run baseline.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "providers": [
        "cloudflare",
        "github",
        "fastly"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("defenestrator/cloud-ip-range-drift-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "providers": [
        "cloudflare",
        "github",
        "fastly",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("defenestrator/cloud-ip-range-drift-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "providers": [
    "cloudflare",
    "github",
    "fastly"
  ]
}' |
apify call defenestrator/cloud-ip-range-drift-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=defenestrator/cloud-ip-range-drift-monitor",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "Cloud IP Range Drift Monitor",
        "description": "Monitor official AWS, Google, Cloudflare, GitHub, and Fastly IP range feeds for firewall allowlist and network perimeter drift.",
        "version": "0.0",
        "x-build-id": "hJegQ71TPXwA6dFhC"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/defenestrator~cloud-ip-range-drift-monitor/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-defenestrator-cloud-ip-range-drift-monitor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/defenestrator~cloud-ip-range-drift-monitor/runs": {
            "post": {
                "operationId": "runs-sync-defenestrator-cloud-ip-range-drift-monitor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/defenestrator~cloud-ip-range-drift-monitor/run-sync": {
            "post": {
                "operationId": "run-sync-defenestrator-cloud-ip-range-drift-monitor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "properties": {
                    "providers": {
                        "title": "Official providers to check",
                        "type": "array",
                        "description": "Provider feeds to fetch from fixed official public sources. Supported values: aws, google-cloud, google, cloudflare, github, fastly.",
                        "default": [
                            "cloudflare",
                            "github",
                            "fastly"
                        ],
                        "items": {
                            "type": "string"
                        }
                    },
                    "previousSnapshot": {
                        "title": "Previous OUTPUT.snapshot object",
                        "type": "object",
                        "description": "Optional snapshot object copied from a previous run's OUTPUT.snapshot. When supplied, the Actor outputs added/removed CIDR rows and provider summary alerts.",
                        "default": {}
                    },
                    "previousSnapshotJson": {
                        "title": "Previous snapshot JSON text",
                        "type": "string",
                        "description": "Optional JSON text version of a previous OUTPUT.snapshot. This is useful when calling the Actor by API or when the Console object editor is inconvenient.",
                        "default": ""
                    },
                    "focusServices": {
                        "title": "Focus services/categories",
                        "type": "array",
                        "description": "Optional case-insensitive service/category names to highlight, such as actions, hooks, CLOUDFRONT, AMAZON, cloudflare-edge, or fastly-edge.",
                        "default": [],
                        "items": {
                            "type": "string"
                        }
                    },
                    "focusRegions": {
                        "title": "Focus regions/scopes",
                        "type": "array",
                        "description": "Optional case-insensitive regions/scopes to highlight, such as us-east-1, GLOBAL, global, or asia.",
                        "default": [],
                        "items": {
                            "type": "string"
                        }
                    },
                    "includeCurrentPrefixes": {
                        "title": "Include current prefix rows",
                        "type": "boolean",
                        "description": "If true, push current prefix rows in addition to summary and delta rows. Leave false for low-cost scheduled drift monitoring.",
                        "default": false
                    },
                    "maxCurrentRows": {
                        "title": "Maximum current prefix rows",
                        "minimum": 1,
                        "maximum": 50000,
                        "type": "integer",
                        "description": "Cap current prefix rows per run when includeCurrentPrefixes=true. Delta rows are not capped by this setting.",
                        "default": 5000
                    },
                    "maxProviders": {
                        "title": "Maximum providers per run",
                        "minimum": 1,
                        "maximum": 6,
                        "type": "integer",
                        "description": "Safety cap for selected provider count.",
                        "default": 6
                    },
                    "requestTimeoutSecs": {
                        "title": "Request timeout seconds",
                        "minimum": 5,
                        "maximum": 120,
                        "type": "integer",
                        "description": "Timeout for each official feed request.",
                        "default": 25
                    },
                    "maxSourceBytes": {
                        "title": "Maximum source response bytes",
                        "minimum": 65536,
                        "maximum": 10485760,
                        "type": "integer",
                        "description": "Maximum bytes accepted from each official source feed. AWS can exceed 2 MB, so do not set this too low for all-provider runs.",
                        "default": 5242880
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```