This might help the documentaiton for SplunkCloud customers, it took me a minute to figure out.

[out-of-mana]

If you're a Splunkcloud customer, once you've successfully deployed all the resources you'll need to ensure that your Splunkcloud instance has the Kinesis Data Firehose egress CIDRs allow listed under "Server Settings" > "IP Allow List Management" > "HEC access for ingestion"

For more details on the relevant CIDRs: https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-splunk-vpc