Build one app that takes an IP address, a port and a reason, and adds the rule to one specific firewall. Give the people who usually ask a role that can run it. They fill in the form, the rule is added straight away, and the request is logged. A scheduled job removes rules once they expire.
It is a two-minute change: open the console, find the rule, add an address, save. The trouble is how often it comes up. A new vendor, a sales engineer at a customer site, a CI runner that changed address overnight. Each one is a ticket, and each ticket pulls an engineer away from whatever they were doing.
Here is how we would set it up so the person who needs access can grant it to themselves, inside limits you decide in advance.
Decide what the app is allowed to do
Before building anything, write down the boundaries. A safe whitelisting app usually:
- takes a single address, a port and a reason
- changes one named firewall and nothing else
- only accepts the ports you expect, such as 443
- records who asked, why, and until when
What changes afterwards
The request still happens. It just stops being a ticket. The person who needs access has it within a minute, nobody is interrupted, and you have a record of every address that was added, by whom and why.
When an auditor asks how firewall changes are approved, you can show them the role and the log instead of a Slack thread.
Set it up in six steps
- 1Describe it
In the Intelligent Builder, describe the change and its limits in a sentence or two. DevAutOps writes the function, generates a form with the right fields and tests it against a sample request.
- 2Check the code
Open the generated function and confirm it targets the firewall you meant and validates the address. You can edit it directly if something is off.
- 3Store the credential
Keep the cloud credential the app uses in Secrets, with permission to change that one firewall and nothing more.
- 4Choose who can run it
Give the people who usually ask, such as support or sales engineering, a role that can run this app. They do not get console access.
- 5Share the link
The app ships with a short user guide, so most people can use it without asking how.
- 6Add an expiry job
Create an AI Job that runs nightly and removes rules past their expiry date. Run it as a dry run first to see what it would remove.
Questions
How do I automate IP whitelisting requests in AWS?
Describe the change and its limits to the DevAutOps Intelligent Builder. It generates a form and the code that adds the rule to the firewall you name, and the people who usually ask can then run it themselves.
Does the requester need AWS access?
No. They need a role that can run the app. The credential the app uses is stored in Secrets and is never shown to them.
Can whitelisted addresses expire automatically?
Yes. Pair the app with a scheduled AI Job that removes rules after their expiry date, so temporary access does not quietly become permanent.