add Network and Firewall Requirements page with list of domains

Author: swibi-ttd

docs/guides/operator-guide-aks-enclave.md

@@ -254,6 +254,10 @@ az network vnet subnet update \
     --nat-gateway ${NAT_GATEWAY_NAME}
 ```
 
+:::note
+The NAT gateway provides the operator's outbound internet access. If your environment restricts outbound network traffic, you must allow the destinations listed in [Network and firewall requirements](operator-private-network-requirements.md).
+:::
+
 #### Get the AKS Subnet ID
 
 To create the AKS subnet ID, run the following command, using your own values as needed:

docs/guides/operator-guide-aws-marketplace.md

@@ -154,7 +154,7 @@ To avoid passing certificates associated with your domain into the enclave, inbo
 | ----------- | --------- | -------- | ------ |
 | 80 | Inbound | HTTP | Serves all UID2 APIs, including the healthcheck endpoint `/ops/healthcheck`.<br/>When everything is up and running, the endpoint returns HTTP 200 with a response body of `OK`. For details, see [Checking UID2 Operator status](#checking-uid2-operator-status). |
 | 9080 | Inbound | HTTP | Serves Prometheus metrics (`/metrics`). |
-| 443 | Outbound | HTTPS | Calls the UID2 Core Service, AWS S3, to download files for opt-out data and key store. |
+| 443 | Outbound | HTTPS | Calls the UID2 Core Service and AWS S3, to download files for opt-out data and key store. If your environment restricts outbound network traffic, you must allow the destinations listed in [Network and firewall requirements](operator-private-network-requirements.md). |
 
 ### VPC chart
 

docs/guides/operator-guide-azure-enclave.md

@@ -330,7 +330,7 @@ The following table provides information about supported protocols.
 | ----------- | --------- | -------- | ------ |
 | 80 | Inbound | HTTP | Serves all UID2 APIs, including the health check endpoint `/ops/healthcheck`.<br/>When everything is up and running, the endpoint returns HTTP 200 with a response body of `OK`. For details, see [Running the health check](#running-the-health-check). |
 | 9080 | Inbound | HTTP | Serves Prometheus metrics (`/metrics`). For details, see [Scraping metrics](#scraping-metrics). |
-| 443 | Outbound | HTTPS | Calls the UID2 Core Service and Azure Blob Storage, to download files for opt-out data and key store. |
+| 443 | Outbound | HTTPS | Calls the UID2 Core Service and AWS S3, to download files for opt-out data and key store. If your environment restricts outbound network traffic, you must allow the destinations listed in [Network and firewall requirements](operator-private-network-requirements.md). |
 
 ## Upgrading
 

docs/guides/operator-private-gcp-confidential-space.md

@@ -90,6 +90,8 @@ Before choosing your deployment option, complete these Google Cloud setup steps:
 
 1. Enable egress rule. If your VPC infrastructure only allows egress to known endpoints, you will need to enable an egress rule to allow the operator to retrieve the certificates required for attestation. To enable this, follow the details in this document from Google: [VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/supported-products#table_confidential_space).
 
+   You must also allow outbound access to the UID2 service and storage destinations that the operator depends on. For the full list, see [Network and firewall requirements](operator-private-network-requirements.md).
+
 ### UID2 Operator account setup
 
 Ask your UID2 contact to register your organization as a UID2 Operator. If you're not sure who to ask, see [Contact info](../getting-started/gs-account-setup.md#contact-info).

docs/guides/operator-private-network-requirements.md

@@ -0,0 +1,39 @@
+---
+title: Private Operator network and firewall requirements
+sidebar_label: Network and firewall requirements
+pagination_label: Private Operator network and firewall requirements
+description: Outbound network destinations a Private Operator must reach, for configuring egress firewall allowlists.
+hide_table_of_contents: false
+sidebar_position: 16
+displayed_sidebar: docs
+---
+
+import Link from '@docusaurus/Link';
+
+# Private Operator network and firewall requirements
+
+A <Link href="../ref-info/glossary-uid#gl-private-operator">Private Operator</Link> connects to the UID2 <Link href="../ref-info/glossary-uid#gl-core-service">Core</Link> and <Link href="../ref-info/glossary-uid#gl-opt-out-service">Opt-Out</Link> services, and downloads data files directly from AWS S3 using URLs that the Core service provides. For details, see [Private Operator workflow](integration-options-private-operator.md#private-operator-workflow).
+
+If your environment restricts outbound network traffic, you must allow outbound HTTPS (port 443) to all of the destinations below, or the operator cannot start.
+
+## Integration
+
+| Hostname | Purpose |
+| --- | --- |
+| `core-integ.uidapi.com` | Core Service (attestation, keys, salts, configuration) |
+| `optout-integ.uidapi.com` | Opt-Out Service |
+| `uid2-core-integ-store.s3.us-east-2.amazonaws.com` | Core data storage |
+| `uid2-optout-integ-store.s3.us-east-2.amazonaws.com` | Opt-out data storage |
+
+## Production
+
+| Hostname | Purpose |
+| --- | --- |
+| `core-prod.uidapi.com` | Core Service (attestation, keys, salts, configuration) |
+| `optout-prod.uidapi.com` | Opt-Out Service |
+| `uid2-core-prod-store.s3.us-east-2.amazonaws.com` | Core data storage |
+| `uid2-core-prod-store-replica.s3.us-west-2.amazonaws.com` | Core data storage (failover replica) |
+| `uid2-optout-prod-store.s3.us-east-2.amazonaws.com` | Opt-out data storage |
+| `uid2-optout-prod-store-replica.s3.us-west-2.amazonaws.com` | Opt-out data storage (failover replica) |
+
+Allow these by hostname rather than by IP address, as the underlying addresses change.

sidebars.js

@@ -259,6 +259,7 @@ const fullSidebar = [
             'guides/operator-private-gcp-confidential-space',
             'guides/operator-guide-azure-enclave',
             'guides/operator-guide-aks-enclave',
+            'guides/operator-private-network-requirements',
           ],
         },
       ],