The TFC documentation at IP Ranges - API Docs - Terraform Cloud and Terraform Enterprise | Terraform by HashiCorp describes a public access API that returns a list of IP addresses which TFC uses for outbound connections.
The API currently returns a list of IPv4 addresses. During my troubleshooting I saw TFC connecting to my Vault instance over IPv6.
The above API is returning incomplete information.
Some more details:
At the time of writing, the API is returning the following information:
curl \
--request GET \
-H "If-Modified-Since: Tue, 26 May 2020 15:10:05 GMT" \
https://app.terraform.io/api/meta/ip-ranges
{"api":["75.2.98.97/32","99.83.150.238/32"],"notifications":["52.86.200.106/32","52.86.201.227/32","52.70.186.109/32","44.236.246.186/32","54.185.161.84/32","44.238.78.236/32"],"sentinel":["52.86.200.106/32","52.86.201.227/32","52.70.186.109/32","44.236.246.186/32","54.185.161.84/32","44.238.78.236/32"],"vcs":["52.86.200.106/32","52.86.201.227/32","52.70.186.109/32","44.236.246.186/32","54.185.161.84/32","44.238.78.236/32"]}
I was attempting to use TFC with a Vault instance which has native IPv6. TFC was unable to reach my Vault instance, even after I added the above IPv4 addresses to the Vault hosts allowed IPv4 ranges.
I modified my IPv6 rules to permit access from any IPv6 address and now TFC is able to access my Vault instance.
Conclusion is, that the above API is returning an incomplete list of TFC source addresses.