Documentation +

Static IP guide

Making API requests with a static IP from a Java app on AWS Lambda

Java on Lambda pairs with Fixie through OkHttp: parse FIXIE_URL, attach the proxy and a proxyAuthenticator, and build the client in the handler class's constructor so it survives warm starts. Partners see a fixed address pair without your function joining a VPC.

RuntimeJava
PlatformAWS Lambda
DestinationAPI allowlisting
Fixie productFixie HTTP/S proxy

Recommended setup

Use Fixie HTTP/S proxy for HTTP and HTTPS requests to an API, webhook provider, or service that allowlists outbound IP addresses. Store the proxy value in FIXIE_URL, then configure Java to route outbound traffic through Fixie before connecting to API allowlisting.

Set up Fixie on AWS Lambda

Create a Fixie HTTP/S proxy in the Fixie dashboard. Copy the proxy value into AWS Lambda environment variables as FIXIE_URL, and copy the outbound IPs into the destination allowlist.

Set an AWS Lambda environment variable

aws lambda update-function-configuration \
  --function-name YOUR_FUNCTION \
  --environment "Variables={FIXIE_URL=...}"

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Make an HTTP request through FIXIE_URL

String fixieUrl = System.getenv("FIXIE_URL");
String[] fixieValues = fixieUrl.split("[/(:\\/@)/]+");

String fixieUser = fixieValues[1];
String fixiePassword = fixieValues[2];
String fixieHost = fixieValues[3];
int fixiePort = Integer.parseInt(fixieValues[4]);

OkHttpClient client = new OkHttpClient.Builder()
    .proxy(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(fixieHost, fixiePort)))
    .proxyAuthenticator((route, response) -> {
        String credential = Credentials.basic(fixieUser, fixiePassword);
        return response.request().newBuilder()
            .header("Proxy-Authorization", credential)
            .build();
    })
    .build();

Good to know

  • Client construction is exactly the kind of work warm starts and SnapStart amortize — never build the OkHttpClient per request.
  • If you route through JVM system properties instead, clear jdk.http.auth.tunneling.disabledSchemes; modern JVMs otherwise refuse Basic proxy auth on HTTPS tunnels.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the API provider.
  3. Deploy the updated Java app on AWS Lambda.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs