# Tulip Player: Allow updates without requiring broad access to s3.amazonaws.com (Enterprise / Air‑gapped environments)
**URL:** https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011
**Category:** Product Suggestions
**Tags:** feature-request
**Created:** [January 15, 2026, 9:54pm UTC](https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011 "2026-01-15T21:54:22Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@VincentR](https://community.tulip.co/u/VincentR)
#### Post date: [January 15, 2026, 9:54pm UTC](https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011/1 "2026-01-15T21:54:22Z")
**Context & Probleme description:**
In our factory environment, Tulip Player is running on Android tablets deployed in a highly restricted OT network (almost air‑gapped).
Outbound internet access is limited and strictly controlled by domain allow‑listing.
We currently whitelist and trust the following Tulip-controlled domains:
`*.tulip.co` (including our instance domain)
`download.tulip.co`
`*.tulip-custom-widgets.com`
This allows normal Player operation.
**However** , Tulip Player updates are distributed via Amazon S3 under the shared domain:
`s3.amazonaws.com` (e.g. `https://s3.amazonaws.com/co.tulip.cdn/`)
From a security standpoint, it is not reasonable for us (or most industrial IT/OT teams) to whitelist the entire `s3.amazonaws.com` domain, as it is a multi‑tenant global storage endpoint well outside Tulip’s control.
As a result:
- Player auto‑updates are blocked in our OT network
- Tablets periodically get stuck requiring an update
- Our current workaround is to manually move tablets to a separate “office” network to perform updates, which is operationally painful and error‑prone
**Requested Feature / Improvements:**
We would like to request an enterprise‑friendly update distribution mechanism that does not require allowing access to `s3.amazonaws.com`.
Examples of possible solutions (any of these would solve the problem):
1. Host Player update artifacts on a Tulip‑controlled domain
For example:
`updates.tulip.co` or reuse `download.tulip.co`
This would allow customers to safely whitelist a Tulip‑owned domain only.
2. Support a configurable update endpoint (advanced / enterprise option)
Allow the Player to be configured with a custom update base URL(via configuration file, environment variable, managed setting…)
This would allow customers to place a reverse proxy under their control in front of Tulip’s S3 backend.
---
### Author:  [@jasonh](https://community.tulip.co/u/jasonh)
#### Post date: [January 16, 2026, 8:45pm UTC](https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011/2 "2026-01-16T20:45:52Z")
Could you investigate an MDM solution or possibly have the tablets connect to a VM that’s within your factory network?
---
### Author:  [@VincentR](https://community.tulip.co/u/VincentR)
#### Post date: [February 16, 2026, 10:46am UTC](https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011/3 "2026-02-16T10:46:32Z")
Hi jasonh,
Thanks for your response, and sorry for the late reply.
I’m slightly worried about the effort required to implement an MDM solution on our side. Do you have any pointers or documentation you could share, in case we explore that path?
Thanks
---
### Author:  [@jasonh](https://community.tulip.co/u/jasonh)
#### Post date: [February 17, 2026, 4:04pm UTC](https://community.tulip.co/t/tulip-player-allow-updates-without-requiring-broad-access-to-s3-amazonaws-com-enterprise-air-gapped-environments/16011/4 "2026-02-17T16:04:45Z")
Yes, I’ve looked into MDM for air gapped environments. I haven’t looked too deep, but I focused on 2 different companies:
Ivanti (Offers cloud based and on-premise solutions)
[Ivanti MDM for Classified & Air-Gapped Networks](https://www.ivanti.com/resources/v/doc/ivi/2839/161d2de29bb3)
Plane (Didn’t look into specific solution offers, but I believe they offer both cloud and on-premise options)
[Air-Gapped Project Management for Secure Environments | Plane](https://plane.so/airgapped)
Ultimately, we shifted to other devices and put wireless devices on the backburner. Hopefully this helps!