"CBN" revalidation on the firewall holes for the release team.

[sxa]

As mentioned in slack we should go through the firewall rules on the staging server and remove some of the old "holes" that we have in there. Since we log them all in the configuration files against the user that requested them this should be fairly easy.

(I use the term CBN in the title as "Continued Business Need" which is what needs to be checked)

[richardlau]

I think the script we have which has the ip addresses listed is additive, i.e. if we remove entries from the script, it wouldn't actually remove them from the firewall.

[ryanaslett]

I was planning on investigating setting up cloudflare zerotrust as an alternative to firewall holes for humans.