Our setup has integrations that access Salesforce through service users. This users profiles have IP whitelists. Now a new system has Internet-facing IP ranges that depend on the environment (production, staging, dev etc.). For good security, only the staging environment should communicate with the staging sandbox, production with production etc.
We try to automate as much as possible when refreshing sandboxes, using the SandboxPostCopy Apex interface. We also handle environment-specific changes with this class.
What would be a good way to automatically change the IP restrictions on the profile when a sandbox is refreshed?
Probably possible, but a rather heavy approach, would be calling the Metadata API from Apex, as described here.
The Apex Metadata API does not support updating profiles.
Any other ideas?