Bitbucket GCP whitelisting IPs

[Elena Dzhordzhilova]

Dear Bitbucket Community, 

I wanted to ask if you have an idea what could cause the following issue:

Invalid resource state for "projects/elena-project/locations/europe-west3/secrets/bitbucketCloudApiToken-21wfz/versions/latest": failed to verify authorizer token: Get "https://api.bitbucket.org/2.0/repositories/elena-ws/repository-elena-ws/hooks": generic::permission_denied: 403: To access this repository, an admin must whitelist your IP.

I have a workspace which works only with whitelisted IPs. I also have a newly created GCP project which I want to connect with Bitbucket in Big Query Dataform. The problem is that I generated the tokens for read and admin access for the integration, but it says that I need to whitelist an IP to proceed with the integration. However, Big Query does not have specific IP ranges, I added the one from the Dataform documentation range per my GCP region, but the result is the same. I use Developer Connect as recommended one in GCP, but cannot figure out which IP/ranges should I whitelist?

There are no specific nats, vpcs or another network restrictions in GCP.

pp. The workspace, repository and token names were changed.

Best Regards, 

Elena

[Tomislav Tobijas]

Hi @Elena Dzhordzhilova ,

Here's an article that might help: Error 403 when performing Git operations 

In your case, you would need to ensure that the entire range used by the GCP service in your region is added to a whitelist. 
The token you're using would also need to have the necessary Repository Admin permissions, as some integrations do require this level of access.

Like, the ideal scenario would be that you don't have whitelisting at all 😅 as, in too many cases, you would have to periodically update the allowlist once things change at the source platform 🫤

What you could also check is Developer Community. Maybe someone in there would have some better insights around this, but it might also be a good idea to reach out to third-party vendors to check what they have to say.
Apart from all of this, it might be worth reaching out to Atlassian Support if you're on a paid plan to see if they have anything smart to say 👀

Cheers,
Tobi

[Elena Dzhordzhilova]

Also checked for additional GCP restrictions inside the policies, but "Restrict git remotes for repositories in Dataform" which is responsible for the Git integrations is disabled. Also the IP ranges for IPv4 inbound for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org are whitelisted.