Skip to content

Commit

Permalink
[GHEC version] Version content for IP allow lists (github#26067)
Browse files Browse the repository at this point in the history
  • Loading branch information
lecoursen authored Mar 11, 2022
1 parent a6b4d5e commit 59618c6
Show file tree
Hide file tree
Showing 7 changed files with 23 additions and 12 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ github-registry-files.githubusercontent.com

In addition, your workflow may require access to other network resources. For example, if your workflow installs packages or publishes containers to {% data variables.product.prodname_dotcom %} Packages, then the runner will also require access to those network endpoints.

If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list)" or "[Enforcing policies for security settings in your enterprise](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise)".
If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. For more information, see "[Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list)" or "[Enforcing policies for security settings in your enterprise](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}

{% else %}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ To use codespaces in your organization, you must do the following:
- Ensure that users have [at least write access](/organizations/managing-access-to-your-organizations-repositories/repository-permission-levels-for-an-organization) to the repositories where they want to use a codespace.
- [Enable {% data variables.product.prodname_codespaces %} for users in your organization](#enable-codespaces-for-users-in-your-organization). You can choose to allow {% data variables.product.prodname_codespaces %} for selected users or only for specific users.
- [Set a spending limit](/billing/managing-billing-for-github-codespaces/managing-spending-limits-for-codespaces)
- Ensure that your organization does not have an IP address allow list enabled. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization)."
- Ensure that your organization does not have an IP address allow list enabled. For more information, see "[Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}

By default, a codespace can only access the repository from which it was created. If you want codespaces in your organization to be able to access other organization repositories that the codespace creator can access, see "[Managing access and security for {% data variables.product.prodname_codespaces %}](/codespaces/managing-codespaces-for-your-organization/managing-access-and-security-for-your-organizations-codespaces)."

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Enterprise and organization owners can restrict access to assets by configuring
When an organization has an allow list, third-party applications that connect via a {% data variables.product.prodname_github_app %} will be denied access unless both of the following are true:

* The creator of the {% data variables.product.prodname_github_app %} has configured an allow list for the application that specifies the IP addresses at which their application runs. See below for details of how to do this.
* The organization owner has chosen to permit the addresses in the {% data variables.product.prodname_github_app %}'s allow list to be added to their own allow list. For more information, see "[Managing allowed IP addresses for your organization](/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#allowing-access-by-github-apps)."
* The organization owner has chosen to permit the addresses in the {% data variables.product.prodname_github_app %}'s allow list to be added to their own allow list. For more information, see "[Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list){% ifversion fpt %}" in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}."{% endif %}

{% data reusables.apps.ip-allow-list-only-apps %}

Expand Down
Original file line number Diff line number Diff line change
@@ -1,26 +1,31 @@
---
title: Managing allowed IP addresses for your organization
intro: You can restrict access to your organization's private assets by configuring a list of IP addresses that are allowed to connect.
product: '{% data reusables.gated-features.allowed-ip-addresses %}'
redirect_from:
- /github/setting-up-and-managing-organizations-and-teams/managing-allowed-ip-addresses-for-your-organization
- /organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization
versions:
fpt: '*'
ghae: '*'
ghec: '*'
topics:
- Organizations
- Teams
shortTitle: Manage allowed IP addresses
permissions: Organization owners can manage allowed IP addresses for an organization.
---

Organization owners can manage allowed IP addresses for an organization.

## About allowed IP addresses

You can restrict access to private organization assets by configuring an allow list for specific IP addresses. {% data reusables.identity-and-permissions.ip-allow-lists-example-and-restrictions %}

{% ifversion ghec %}
{% note %}

**Note:** Only organizations that use {% data variables.product.prodname_ghe_cloud %} can use IP allow lists. {% data reusables.enterprise.link-to-ghec-trial %}

{% endnote %}
{% endif %}

{% data reusables.identity-and-permissions.ip-allow-lists-cidr-notation %}

{% data reusables.identity-and-permissions.ip-allow-lists-enable %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,9 @@ To search for specific events, use the `action` qualifier in your query. Actions
| [`discussion_post_reply`](#discussion_post_reply-category-actions) | Contains all activities related to replies to discussions posted to a team page.{% ifversion fpt or ghes or ghec %}
| [`enterprise`](#enterprise-category-actions) | Contains activities related to enterprise settings. | {% endif %}
| [`hook`](#hook-category-actions) | Contains all activities related to webhooks.
| [`integration_installation_request`](#integration_installation_request-category-actions) | Contains all activities related to organization member requests for owners to approve integrations for use in the organization. |
| [`ip_allow_list`](#ip_allow_list) | Contains activities related to enabling or disabling the IP allow list for an organization.
| [`ip_allow_list_entry`](#ip_allow_list_entry) | Contains activities related to the creation, deletion, and editing of an IP allow list entry for an organization.
| [`integration_installation_request`](#integration_installation_request-category-actions) | Contains all activities related to organization member requests for owners to approve integrations for use in the organization. |{% ifversion ghec or ghae %}
| [`ip_allow_list`](#ip_allow_list-category-actions) | Contains activities related to enabling or disabling the IP allow list for an organization.
| [`ip_allow_list_entry`](#ip_allow_list_entry-category-actions) | Contains activities related to the creation, deletion, and editing of an IP allow list entry for an organization.{% endif %}
| [`issue`](#issue-category-actions) | Contains activities related to deleting an issue. {% ifversion fpt or ghec %}
| [`marketplace_agreement_signature`](#marketplace_agreement_signature-category-actions) | Contains all activities related to signing the {% data variables.product.prodname_marketplace %} Developer Agreement.
| [`marketplace_listing`](#marketplace_listing-category-actions) | Contains all activities related to listing apps in {% data variables.product.prodname_marketplace %}.{% endif %}{% ifversion fpt or ghes or ghec %}
Expand Down Expand Up @@ -360,6 +360,7 @@ An overview of some of the most common actions that are recorded as events in th
| `create` | Triggered when an organization member requests that an organization owner install an integration for use in the organization.
| `close` | Triggered when a request to install an integration for use in an organization is either approved or denied by an organization owner, or canceled by the organization member who opened the request.

{% ifversion ghec or ghae %}
### `ip_allow_list` category actions

| Action | Description
Expand All @@ -376,6 +377,7 @@ An overview of some of the most common actions that are recorded as events in th
| `create` | Triggered when an IP address was added to an IP allow list.
| `update` | Triggered when an IP address or its description was changed.
| `destroy` | Triggered when an IP address was deleted from an IP allow list.
{% endif %}

### `issue` category actions

Expand Down
1 change: 0 additions & 1 deletion data/reusables/gated-features/allowed-ip-addresses.md

This file was deleted.

7 changes: 6 additions & 1 deletion lib/redirects/static/redirect-exceptions.txt
Original file line number Diff line number Diff line change
Expand Up @@ -445,4 +445,9 @@
- /articles/restricting-the-ability-to-add-outside-collaborators-to-organization-repositories
- /articles/setting-permissions-for-adding-outside-collaborators
- /github/setting-up-and-managing-organizations-and-teams/setting-permissions-for-adding-outside-collaborators
- /organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators
- /organizations/managing-organization-settings/setting-permissions-for-adding-outside-collaborators

/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization
- /github/setting-up-and-managing-organizations-and-teams/managing-allowed-ip-addresses-for-your-organization
- /organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization
- /organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization

0 comments on commit 59618c6

Please sign in to comment.