landing-zone-allowed-public-ip

Type: decision

Decision

The platform provides an approved public IP address, so getting-started deployment pipelines can enable/disable network access to Azure resources.

Why

Without this, application teams cannot access Azure data-plane resources from their laptops.

Links

• config-lives-in-the-repo — The IP is defined in githubVariables.json and propagated as an org variable.
• deny-security-controls — Deny policies are unchanged — firewall configuration is the application team's responsibility.
• job-function-scoped-roles — RBAC roles already grant the authorization — the public IP provides the missing network path.
• landing-zone-getting-started — Getting-started modules use this IP to open and close firewall access.

← Back to all decisions