Guidance on Whitelisting IPs for Bitbucket Pipelines (1x and 2x)

[Samiselvam]

Hi,

In our infrastructure, we are running Bitbucket Pipelines using 1x or 2x instances. When we attempted to use 4x, we encountered an error stating that only 1x or 2x are allowed.

After checking the documentation and blogs, I found that IP whitelisting is not available for 1x and 2x steps. Could you please guide us on the necessary actions to enable Bitbucket Pipelines with 1x and 2x while ensuring IP whitelisting?

Looking forward to your response.

[Theodora Boudale · Accepted solution]

Hi @Samiselvam  and welcome to the community!

Can you please clarify where exactly you see the message that only 1x or 2x are allowed? Does this show as an error in a build you run? Or when you edit the bitbucket-pipelines.yml file of your repo? It would be useful to have a screenshot (with any private info blurred) so we can better help you.

The message in the screenshot you shared indicates that IP allowlisting is enabled on your workspace, so the IPs of the Pipelines environments need to be allowlisted in your workspace's allowlist.

If you plan to use Pipelines steps of size 4x or larger, you can find the IPs used by these Pipelines steps below:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/#Atlassian-IP-ranges

Please keep in mind that you will also need to adjust your bitbucket-pipelines.yml file to enable the flag atlassian-ip-ranges: true as well. You can find an example here:

• https://support.atlassian.com/bitbucket-cloud/docs/global-options/#Runtime

I am posting an example here as well:

pipelines:
  default:
    - step:
        size: 4x
        runtime:
          cloud:
            atlassian-ip-ranges: true
        script:
          - echo "This step will use atlassian-ip-ranges"

Steps of a size 1x and 2x cannot use this more limited set of IPs I shared, but they run from broader IP ranges. Specifically, they run from the IPs listed below:

• https://ip-ranges.amazonaws.com/ip-ranges.json

filtering to records where the service equals EC2 or S3, and using the us-east-1 and us-west-2 regions. However, we do not recommend using these IP ranges as a security control due to their broad nature.

Please feel free to reach out if you have any questions!

Kind regards,
Theodora