Since App Maker uses Apps Script's URL Fetch service, you need to look at their doc to answer this question. From what I can tell from:
https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app
You need to go here:
https://cloud.google.com/appengine/kb/#static-ip
And then follow these instructions. Since Stack Overflow has an issue with simply posting links (although I really recommend you go to the link :), I'll summarize the instructions here:
nslookup -q=TXT _cloud-netblocks.googleusercontent.com 8.8.8.8
And then nslookup each "include" in the response. This gives you all the IPs currently in use.
Edit: It looks like this might be the same IPs Google uses for it's general URL fetch service, which could mean that if you're whitelisting for these IPs you may also whitelist for all App Engine applications, and probably even more. Obviously you'd be whitelisting for all Apps Script and App Maker applications, so I assume this doesn't matter, but I just wanted to mention it. If your service is trying to rely on this for security reasons then, obviously, it's not adequate.