IP whitelisting

[Maarten Kooiker]

My bitbucket pipelines are broken, due to ssh connection issues. When I whitelist all traffic from any IP address to any port, the pipeline runs fine. Hoewever when I block all, except for all IP addresses listed below the pipeline fails: 

https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/ 

When logging the IP address that is used in the pipeline I get a different IP address each time. (for example: 34.227.72.172, which is not listed on the whitelist page mentioned above). 

Size = 2x, but changing that to 4x does not help either.

[Theodora Boudale · Accepted solution]

Hi Maarten and welcome to the community!

The documentation of Bitbucket Pipelines Cloud IP addresses is divided into two sections:

• Section 1: Valid IP addresses for Bitbucket Pipelines build environments

  This section applies to 1x/2x step sizes (or 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges).
  
  An exhaustive list of IP addresses from which the traffic may originate on AWS can be obtained by using the following endpoint:
  
  https://ip-ranges.amazonaws.com/ip-ranges.json
  
  You should filter records where the service equals EC2 or S3, and focus on the us-east-1 and us-west-2 regions. However, we do not recommend using these IP ranges as a security control due to their broad nature.
  
  

• Section 2: Atlassian IP Ranges

  This section pertains to steps specifically configured to use Atlassian IP ranges. These are applicable only to 4x size steps and larger that have the atlassian-ip-ranges: true flag enabled. The step sizes 4, 8x, 16x are only available for builds running under a paid Bitbucket Cloud plan (Standard or Premium).
  
  If you'd like your Pipelines step to use this more restricted IP ranges, you can adjust your Pipelines configuration as follows:
  
  

pipelines:
  default:
    - step:
        size: 4x
        runtime:
          cloud:
            atlassian-ip-ranges: true
        script:
          - echo "This step will use atlassian-ip-ranges"

You can find more details in the documentation here: Runtime Step Options. This configuration improves security by restricting the IP addresses utilized by Pipelines builds to the Atlassian IP ranges.

Please Note: Opting for larger step sizes (4x/8x/16x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

Regarding why the IP you see in the build is not listed in our documentation: our documentation and also https://ip-ranges.amazonaws.com/ip-ranges.json list IP ranges, not specific IP addresses. You can use https://thameera.com/awsip/ to confirm if a certain IP address is from AWS and which subnet it belongs to. 

Kind regards,
Theodora

[Maarten Kooiker]

Thanks, adding this seems to work!

size: 4x
        runtime:
          cloud:
            atlassian-ip-ranges: true

[Theodora Boudale]

That's good to hear, Maarten, and you are very welcome!

Please feel free to reach out if you ever need anything else!

[Maarten Kooiker]

Never mind