Github codespaces IP address range

[callain]

Hello,

First of all I want to say that Codespaces seems like a very promising service!

I would like to know if it's possible to know Github Codespaces IP addresses range?
The goal is to filter online services, such as an online database for development purpose.

We have a use case where it would be really useful to do this instead of working on a local database in a docker container.

Thanks

[tanmayeekamath]

Hey @callain, thanks for your feedback. The current IP address range for Codespaces is dynamic. However, we do have it in our backlog to support a fixed IP range for codespaces to enable allowlisting those to be accessible from your internal services or vice versa. I'll update this thread once we have a timeline on when this would be supported.

Can you share a bit more on where your services are (ex. VPNs, cloud based resources etc.) and what does your networking set up look like?

[genjudev]

For Example it would be perfect for MongoDB Atlas.

[ajunior]

@tanmayeekamath any news about that?

[daviddanielng]

Hey @callain, thanks for your feedback. The current IP address range for Codespaces is dynamic. However, we do have it in our backlog to support a fixed IP range for codespaces to enable allowlisting those to be accessible from your internal services or vice versa. I'll update this thread once we have a timeline on when this would be supported.

Can you share a bit more on where your services are (ex. VPNs, cloud based resources etc.) and what does your networking set up look like?

Hello, its 2024. we still don't have it.

[mikebronner]

We have this requirement from a development/testing perspective with 3rd-party vendors who require whitelisting of machines connecting to their APIs.

[florianm]

I would love to whitelist the GH codespaces IP (range) permanently on our AWS WAF.

Currently this is only possible via the AWS CLI, then updating the WAF IP set.
Some loadbearing bits:

#-----------------------------------------------------------------------------#
# Docs
# AWS CLI v2 using wafv2 (not waf, not waf-regional)
# https://awscli.amazonaws.com/v2/documentation/api/latest/reference/wafv2/update-ip-set.html
# https://repost.aws/knowledge-center/maintain-waf-ipsets-using-cli
# https://jqlang.github.io/jq/manual/

#-----------------------------------------------------------------------------#
# Settings

# AWS WAF IP set
aws_waf_scope="CLOUDFRONT"
aws_waf_region="us-east-1"
aws_waf_ip_set_id="xxx"
aws_waf_ip_set_name="xxx"

# The IAM user $aws_profile has the minimal permissions to execute this script
# Better: use AWS SSO and an IAM role instead of an IAM user
# Permission boundary: AWSWAFConsoleFullAccess
# Permissions: wafv2:GetIPSet, wafv2:UpdateIPSet
# Resource: just the target IP set $aws_waf_ip_set_name
aws_profile=ci-cd-wfh

# Verify or setup profile
if aws configure get aws_access_key_id --profile "$aws_profile" &>/dev/null; then
    echo "AWS CLI v2 profile '$aws_profile' is configured."
else
    echo "Please configure profile '$aws_profile'."

    aws configure --profile "$aws_profile"
fi

aws configure --profile "$aws_profile"

#-----------------------------------------------------------------------------#
# Get IP set
ip_set=$(
    aws wafv2 get-ip-set \
    --profile "$aws_profile" \
    --scope "$aws_waf_scope" \
    --region="$aws_waf_region" \
    --id="$aws_waf_ip_set_id" \
    --name="$aws_waf_ip_set_name"
)

#-----------------------------------------------------------------------------#
# My local IP address
local_ip=$(curl -s https://api64.ipify.org)

#-----------------------------------------------------------------------------#
# Do we have access?
if [[ $(echo "$ip_set" | jq -r '.IPSet.Addresses[]' | grep "$local_ip") ]]; then
    echo "Local IP already has access."
else
    # Add the local IP with CIDR mask /32 to the "Addresses" array
    echo "Adding local IP to IP set..."
    updated_addr=$(
        echo "$ip_set" | \
        jq --arg addr "$local_ip/32" '.IPSet.Addresses += [$addr]' | \
        jq '.IPSet.Addresses'
    )

    # Write addresses to JSON file as input for update-ip-set
    input_json=$(echo "{ \"Addresses\": $updated_addr}")
    temp_file=$(mktemp XXXXXXXX.json)
    echo "$input_json" > "$temp_file"

    # Extract LockToken
    lock_token=$(echo "$ip_set" | jq -r '.LockToken')

    message_info "Updating IP set..."
    aws wafv2 update-ip-set \
        --profile "$aws_profile" \
        --scope "$aws_waf_scope" \
        --region "$aws_waf_region" \
        --id "$aws_waf_ip_set_id" \
        --name "$aws_waf_ip_set_name" \
        --lock-token "$lock_token" \
        --cli-input-json file://"$temp_file"

    rm "$temp_file"
fi

#-----------------------------------------------------------------------------#
# Test access
ip_set_updated=$(
    aws wafv2 get-ip-set \
    --profile "$aws_profile" \
    --scope "$aws_waf_scope" \
    --region="$aws_waf_region" \
    --id="$aws_waf_ip_set_id" \
    --name="$aws_waf_ip_set_name"
)

if [[ $(echo "$ip_set_updated" | jq -r '.IPSet.Addresses[]' | grep "$local_ip") ]]; then
    echo "Local IP $local_ip has been added to IP set."
    
else
    echo "Failed to add local IP to IP set. Exiting."
fi

This is roughly equivalent to this GitHub Action iDVB/wafv2-allow-action.

      - name: Allow GitHub Actions to access AWS
        uses: iDVB/wafv2-allow-action@v1
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.xxx }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.xxx }}
          AWS_DEFAULT_REGION: us-east-1
        with:
          action: add
          ipset_id: xxx
          ipset_name: xxx
          ipset_scope: CLOUDFRONT
          maxRetries: 50