Skip to main content
Last updated: 8 Sep 2025

Update Allowed Ingress IPs for Staging and Integration

We allow the White Chapel Building office networks (both Brattain and GovWifi) to view integration and staging without requiring HTTP Basic Authorisation. Occasionally the IP addresses of these networks change and we need to update the list.

To update the list the process is broadly:

  1. Update the AWS WAF rules
    1. Update the terraform lists
    2. Release a new version of the infrastructure sensitive module
    3. Update the terraform deployment to use the new module version
    4. Apply the terraform
  2. Update the Fastly config
    1. Update the fastly-secrets IP allow lists
    2. Apply the Fastly terraform Workspaces for datagovuk and www

Update the AWS WAF rules

Update the terraform lists

In the terraform-govuk-infrastructure-sensitive repo you need to update the modules/variables/main.tf file.

You need to update the office_ips tfvars section in the sensitive-security-integration module, and also in the sensitive-security-staging module.

NOTE currently there is no pre-commit hook or github actions to validate this is ok. You should run terraform validate in the module prior to merging to main.

Release a new version of the infrastructure-sensitive module

Once the terraform is merged to main you need to:

  1. Go to the infrastructure-sensitive module in the govuk private registry.
  2. Note the current version number (which is listed in the breadcrumb at the top of the page).
  3. Click the Publish New Version button.
  4. From the opened pop up choose a commit (the most recent is at the top, and should be your merge).
  5. Enter a higher version number than the current module version, but keep a note of the version number you have published.

Very quickly it should tell you the new version has been published. If you see it is taking a long time you will need to see the details and resolve whatever is stopping it publishing (usually a terraform syntax error)

Update the terraform deployments to use the new module version

In govuk-infrastructure You need to update the version of the infrastructure-sensitive modules to your new version:

Apply the terraform

Finally, once you have merged the version updates to the infrastructure-sensitive repo you should run the following terraform workspaces (in this order):

Update the Fastly config

Update the fastly-secrets IP allow lists

In the govuk-fastly-secrets git repo you need to update the allowed_ip_addresses list in:

Apply the Fastly Terraform Workspaces for datagovuk and www

After the changes above are merged you need to apply the Terraform Workspaces:

More in the Infrastructure section

Learn

How to...