Which IPs to allow in Azure for Github Actions? - azure

Question

I have an Azure storage account. When I allow all networks to it, my Github Actions can run and update my Azure static website.
When I disallow all but named networks (147.243.0.0/16 and my machine's IP) I get a 403 (request denied) error in Github Actions.
I assume I need to add GitHub to these IPs but when I run:
curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/meta
there are tons of IPs! Do I need to add them all?

Answer 1

I assume you want to allow the GitHub Actions runner access to your storage account? Then yes, since that is potentially a large fleet of VMs, there are ton of IPs you would need to whitelist.
The alternative is to use a few tasks inside your pipeline:
look up the IP of the runner, e.g. using https://api.ipify.org
Add this IP to the allow-list using AZ CLI
Do your actual work on storage
Remove the allow entry again through CLI
Example Code:
name: Deploy to Azure
on:
push:
branches:
- main
workflow_dispatch:
jobs:
publish:
environment: Production
runs-on: ubuntu-latest
steps:
- uses: actions/checkout#v2
- uses: azure/login#v1
with:
creds: ${{ secrets.AZURE_CREDENTIALS }}
- name: Whitelist GitHub Runner IP
uses: azure/CLI#v1
with:
inlineScript: |
set -eu
agentIP=$(curl -s https://api.ipify.org/)
az storage account network-rule add \
--resource-group "${{ secrets.RESOURCE_GROUP }}" \
--account-name "${{ secrets.STORAGE_ACCOUNT_NAME }}" \
--ip-address $agentIP
sleep 300
- name: Upload to blob storage
uses: azure/CLI#v1
with:
inlineScript: |
set -eu
az storage blob upload-batch \
--account-name "${{ secrets.STORAGE_ACCOUNT_NAME }}" \
--source ./src/ \
--destination '$web' \
--overwrite true
- name: Purge CDN endpoint
uses: azure/CLI#v1
with:
inlineScript: |
set -eu
az cdn endpoint purge \
--content-paths "/*" \
--profile-name "${{ secrets.CDN_PROFILE_NAME }}" \
--name "${{ secrets.CDN_ENDPOINT }}" \
--resource-group "${{ secrets.RESOURCE_GROUP }}"
- name: Remove GitHub Runner IP from Whitelist
if: always()
uses: azure/CLI#v1
with:
inlineScript: |
set -eu
agentIP=$(curl -s https://api.ipify.org/)
az storage account network-rule remove \
--resource-group "${{ secrets.RESOURCE_GROUP }}" \
--account-name "${{ secrets.STORAGE_ACCOUNT_NAME }}" \
--ip-address $agentIP
- name: logout
if: always()
run: |
az logout

Answer 2

Now you can assign fixed IP address for your runners. This is in beta, but now doable
Fixed IP ranges
Setup a fixed IP range for your machines by simply ticking a check box, this provides an IP range that can be allow listed in internal systems and in GitHub’s allow list to keep using Actions while making your GitHub environment more secure.