Akeyless SaaS Core Services

The Akeyless Gateway is a stateless Docker container, provided as a standalone or as a cluster. To function correctly, it requires public network connectivity to the Akeyless SaaS core services (see the table below).

A basic Gateway deployment requires a server with a Docker engine installed. You may download the latest Docker engine on Docker website. You'll need public network access enabled on port 443 to pull a Docker image from the hub.docker.com.

📘
Tenant Environments
Accounts that were created on specific environments should modify the services endpoints according to the relevant environments. e.g. for eu https://vault.eu.akeyless.io etc.
Available explicit tenates are: us,eu .

The following table describes the main functionality of Akeyless microservices in the global environment:

Service	IP	Port	Description
Console*: https://console.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128	443	Akeyless SaaS platform
Vault* : https://vault.akeyless.io https://vault-ro.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128	443	User Account Management (UAM), managing user accounts, items, and roles
Auth* : https://auth.akeyless.io https://auth-ro.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128	443	Akeyless Authentication service
Certificate Auth* https://auth-cert.akeyless.io	18.189.176.104	443	Relevant only for Certificate Based Auth
Audit* : https://audit.akeyless.io https://audit-ro.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128	443	Audit log main service, enables log forwarding from GW & Bastion
BIS* : https://bis.akeyless.io https://bis-ro.akeyless.io	52.223.11.194, 35.71.185.167	443	Billing Infrastructure Service (BIS)
Gator* : https://gator.akeyless.io https://gator-ro.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128	443	Main service to sync gateways instances, and connections with Akeyless SaaS
MQ* : amqps://mq.akeyless.io	52.223.11.194, 35.71.185.167	5671	Message queue between Akeyless micro-services
KFM*: https://kfm1.akeyless.io, https://kfm1-ro.akeyless.io, https://kfm2.akeyless.io, https://kfm2-ro.akeyless.io, https://kfm3.akeyless.io, https://kfm3-ro.akeyless.io, https://kfm4.akeyless.io, https://kfm4-ro.akeyless.io	52.223.11.194, 35.71.185.167, 52.223.35.208, 35.71.147.131, 15.197.228.204, 3.33.247.128, 34.120.160.242	443	Key Fragments Services, enabling full DFC encryption
Public Gateway*: https://rest.akeyless.io https://api.akeyless.io	15.197.223.248, 3.33.244.138	443	Optional* Public Gateway rest API v1\v2
Public HVP*: https://hvp.akeyless.io	15.197.223.248, 3.33.244.138	443	Optional* Public HVP endpoint
Logs* : tcp://log.akeyless.io:9997 tcp://log.akeyless.io:9443	35.192.171.171	9997, 9443	GW logs, mainly to be reflected during failure scenarios
https://akeyless-cli.s3.us-east-2.amazonaws.com	N\A	443	S3 bucket to download & update Akeyless CLI versions
https://akeylessservices.s3.us-east-2.amazonaws.com	N\A	443	S3 bucket to download & update Akeyless official binaries. e.g. `Gateway`
https://artifacts.site2.akeyless.io	34.149.100.205	443	Optional* Akeyless official artifacts endpoint. Relevant when working with whitelisted IP range

👍
Note
When using proxy services, you can use https://sqs.us-east-2.amazonaws.com instead of classic MQ services. In case you are not working with proxy serivce, and still want to utilize SQS insted of classic MQ , set your Gateway deployment with the SQS_NO_PROXY="true" environment variable.

Working without MQ Connection

If your organization's policies restrict non-web ports, it's important to understand the potential implications of blocking the MQ connection for your Akeyless setup:

Cross Gateway Access: The MQ service enables retrieving Gateways secrets and objects (i.e. Dynamic/Rotated Secrets, Classic Keys, etc.) across different Gateways and the Akeyless SaaS console. If MQ is blocked, you can still retrieve those secrets directly from their own Gateway. However, requests from other Gateways or the SaaS console will not be processed.
Operational Adjustments: Without the MQ service, you will need to ensure you are working directly with the correct Gateway for each relevant item. This may require additional manual oversight and adjustments compared to a setup with MQ enabled.
Centralized Management: The MQ service allows for centralized management, enabling you to perform all operations from the SaaS console. If MQ is blocked, this convenience will not be available, and you will need to interact directly with individual Gateways.
Event Forwarding relies on the MQ service for publishing event messages to the Gateway. Blocking the MQ connection will prevent event forwarding from working.

Updated 2 days ago