1

How can I allow Azure DevOps Hosted Agent access my Amazon RDS PostgreSql without setting the Security Group to Anywhere. I was looking for IP Range or something to whitelist Azure DevOps Agents but can't find it.

In Azure, I can check a box to grant all "Azure DevOps Services" access to my Azure SQL Database but of course its not present in AWS.

rdagumampan
  • 459
  • 4
  • 16

2 Answers2

0

The IPs used for the hosted Agent IP ranges are linked through here. I have not had much success using it for hosted agents. The list is big and the documentation is not really clear about what types of services you need to whitelist.

I would go with whitelisting the hosted agent IP just-in-time during the pipeline run, then remove it as a final step. First you can grab the ip of the hosted agent:

$hostedIPAddress = Invoke-RestMethod http://ipinfo.io/json | Select -exp ip

Then you could use the AWS CLI or AWS PowerShell module to add the specific IP. Azure DevOps AWS tools task includes the CLI.

Do the needed work against the DB, then make sure you clean up the rule\temp security group at the end.

Eric Smith
  • 2,340
  • 12
  • 16
0

I don't think we can access the Amazon RDS PostgreSql directly from Azure DevOps Hosted Agent, I mean using the hosted service account.

However, Amazon RDS for PostgreSQL Supports User Authentication with Kerberos and Microsoft Active Directory, so we can try writing script to access it by using the specific credential. Then run the scripts in pipeline by adding corresponding tasks (e.g AWS CLI or AWS PowerShell).

Also check How do I allow users to connect to Amazon RDS with IAM credentials?

For the IP ranges, please refer to Allowed address lists and network connections and Microsoft-hosted Agents for details.

Andy Li-MSFT
  • 28,712
  • 2
  • 33
  • 55
  • Thanks. While this does not solve the problem it gives me information on what to do next. It seems the without the complexity of setting up IAM, Kerberos there is no easy way to whitelist Az DevOps Agents in Aws Pgsql Security Group. Its just technically constrained by regions. – rdagumampan Feb 06 '20 at 23:11
  • I guess the feasible approach is to deploy Self-hosted Agents with Public IP that I can whitelist in Aws. – rdagumampan Feb 06 '20 at 23:12