How do I whitelist GitHub actions IP addresses in Azure web app using GitHub's API

user_13402488 0
Viewed 4179

I am trying to whitelist IP addresses for my GitHub actions because right now the workflow fails due to my Azure web app's firewall blocking requests coming from non-whitelisted IP addresses. It seems like there is a list of CIDR format IP addresses in this API provided by Github: https://api.github.com/meta

However I am new to Azure and do not know how to go about whitelisting such a large array of IP addresses from an API in the Azure UI. When I go to my Azure app's "Networking" page, and go to "Access Restrictions" and click on "Configure Access Restrictions", there is a very nice GUI to whitelist individual IP addresses, but it doesn't seem like there's a way to access an API, I am wondering if anyone knows how I should go about trying to access the "actions": [IP1,IP2, etc.] from the GitHub API page linked above, and funnel that array of IPs into my access restrictions config, ideally this would be dynamic because apparently Github updates this page sometimes...

ANY advice appreciated! Thanks in advance.

whitelist github-actions azure api github
1 Answers

You will need a script for this, and the script will need to be run as a user who has RBAC permissions to make changes to the App Service. You will also need Powershell and Azure CLI. You'll need the CLI to add the rules in a scripted fashion.

Powershell: https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell?view=powershell-7.1

Azure CLI: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli

az webapp config commands: https://docs.microsoft.com/en-us/cli/azure/webapp/config/access-restriction?view=azure-cli-latest#az_webapp_config_access_restriction_add

$priority = 200;
$json = Invoke-RestMethod -Uri "https://api.github.com/meta"
foreach($ip in $json.actions){
    if($ip -like "*.*"){
        az webapp config access-restriction add -g <your_resourcegroup_name> -n <your_app_name> --rule-name  --action Allow --ip-address $ip --priority $priority
        Write-Output "$($ip) added to rules."
        $priority++
    }
}

Couple of things:

  1. Priority = 200 in this example, you will likely want to change this to make the allow rules come before all your existing deny rules, so check your existing priorities, I just had to pick a number for this example.

  2. Replace <your_thing_here> with your resource group and app name.

The script is pretty straightforward. Just to be clear, the if($ip -like "*.*") part just weeds out the IPv6 addresses, which aren't needed.

Obviously you'll have to fill in a few blanks here based on your setup, but I hope this helps get you going in the right direction.

user_49006820
Related