How are K12 districts allowing inbound API calls to your SIS from Canvas utilizing OneRoster API?

[andy_holst]

From initial conversations the changing AWS IP addresses make this difficult.  We would like to only allow our Canvas instance to talk to our SIS.