What are the IPV6 address for pipeline outbound traffic

Question

I am trying bitbuket pipeline. Some of my build dependent files are hosted in S3 static site with restricted IP address access in bucket policy. I have added all the IPV4 address mentioned in this article. But still I am getting 403 forbidden within my pipeline. If I gave full access or access to all IPV6 I am able to access my files in s3 bucket.

So my doubt is pipeline to S3 traffic goes via IPv6. I need that list to whitelist in bucket policy.

Thanks.

StannousBaratheon · Accepted Answer

Hi @[deleted]

Bitbucket Pipelines uses a VPC to make requests to S3 and DynamoDB. We do this to significantly increase the performance of caches and artefacts (among other things) and reduce build times for our users. Unfortunately, this also means that requests to those services do not come from the documented public IP ranges.

The internal IPs from AWS service are unpredictable and subject to change so whitelisting these services by source IP is only possible if you bypass the VPC by proxying the request over the public internet. You can do that by setting up a proxy for S3 using AWS API Gateway: https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-s3.html

Alternatively you can host the S3 bucket in a different AWS region to Pipelines which currently runs in us-west-1 and us-east-1.