fix(iac): pin Cosmos ip_range_filter to allow Azure-datacenter traffic#85
Merged
Merged
Conversation
Each tofu apply during CD-dev was reverting the manual Cosmos firewall
fix I'd been setting via az (ipRules = [{0.0.0.0}]). The indexer's
change-feed listener kept 403'ing with:
Request originated from IP 4.153.180.100 through public internet.
This is blocked by your Cosmos DB account firewall settings.
Root cause: the cosmos-account module never declared an ip_range_filter,
so every apply emitted an empty ipRules set. When a Cosmos account has
a private endpoint configured AND public_network_access_enabled = true,
it enters a default 'restricted public' mode that drops public traffic
unless explicitly allowed.
Fix:
- New cosmos-account module variable ip_range_filter (set of strings,
default empty). When set, threads through to azurerm_cosmosdb_account.
Docstring explains the magic value, the AAD-still-gates note, and
the dependency on CAE vnet-integration that would let us remove the
rule in a future spec.
- dev composition passes ip_range_filter = ['0.0.0.0'] — Cosmos's
magic value for 'Allow access from public Azure datacenters'.
Narrower than '0.0.0.0/0' (the entire internet) and AAD/RBAC still
gates every connection regardless of source IP.
- terraform-docs regenerated for the module.
No data plane impact. AAD-only auth remains in force
(local_authentication_disabled = true). Only the network ACL changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
OpenTofu plan —
|
| Rule | Status | Detail |
|---|---|---|
| BT-IAC-001 | PASS | BT-IAC-001: PASS |
| BT-IAC-002 | SKIP (env 'dev' is non-prod; rule is prod-only per Q2c) | BT-IAC-002: SKIP (env 'dev' is non-prod; rule is prod-only per Q2c) |
| BT-IAC-003 | PASS | BT-IAC-003: PASS |
| BT-IAC-004 | PASS | BT-IAC-004: PASS |
| BT-IAC-005 | PASS | BT-IAC-005: PASS |
| BT-IAC-006 | PASS | BT-IAC-006: PASS |
| BT-IAC-007 | PASS | BT-IAC-007: PASS |
Totals: 7 pass · 0 fail · 0 setup error(s)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Indexer's Cosmos change-feed listener has been getting reset every CD-dev run:
I'd been hand-patching this via
az cosmosdb update --ip-range-filter "0.0.0.0"(the Azure-datacenters magic value), but every subsequenttofu applyreverted it because the IaC didn't declare anip_range_filter— so each apply emitted an emptyipRulesset, which Cosmos treats as "no allowed IPs" when a private endpoint is also configured.Fix
Thread
ip_range_filterthroughiac/modules/cosmos-account/so the dev composition can pin the rule.iac/modules/cosmos-account/variables.tfip_range_filtervariable (set(string), default empty). Docstring explains the magic value + the dependency on CAE vnet-integration that would let us remove it later.iac/modules/cosmos-account/main.tfvar.ip_range_filterintoazurerm_cosmosdb_account.ip_range_filter.iac/environments/dev/main.tfip_range_filter = ["0.0.0.0"]to the cosmos-account module.iac/modules/cosmos-account/README.mdSecurity posture
local_authentication_disabled = true)0.0.0.0is Cosmos's magic value for "Allow Azure datacenters", narrower than0.0.0.0/0(entire internet)Test plan
tofu validateclean inenvironments/devterraform-docsregenerated for the moduleaz cosmosdb show -g rg-bt-dev -n cosmos-bt-dev-chdev01 --query ipRulesshows[{0.0.0.0}](persisted across apply); indexer'sRegistryEntityIndexerlistener starts cleanly without 403s🤖 Generated with Claude Code