Bitbucket Cloud does not support webhook secrets, Atlantis integration

Yogi wahyu

Hi all,
I try to integrate my IAC/Terraform bitbucket repo to Atlantis using webhook, the Atlantis are deployed in GKE, but when I create pull request on allowed repo(already configured on `values.yaml`) it return "Bitbucket Cloud does not support webhook secrets...",  The detail log that I have from Atlantis is like this

{
"level": "warn",
"ts": "2023-03-07T10:26:55.534Z",
"caller": "cmd/server.go:1027",
"msg": "Bitbucket Cloud does not support webhook secrets. This could allow attackers to spoof requests from Bitbucket. Ensure you are allowing only Bitbucket IPs",
"json": {},
"stacktrace": "..."
}

 the `values.yaml` that I used to deploy the Atlantis is like this, any suggestion about my issue? please feel free to answer my question.

# Replace this with your own repo allowlist:
orgAllowlist: bitbucket.org/ORGANIZATION_NAME/REPO_NAME
# logLevel: "debug"

...


# If using Bitbucket, specify like the following:
bitbucket:
  user: USER
  token: BITBUCKET_APP_TOKEN

Thanks,

Theodora Boudale

Hi @Yogi wahyu and welcome to the community!

The warning that you get is correct, Bitbucket Cloud webhooks do not support secrets at the moment. We have a feature request about this in our issue tracker:

• https://jira.atlassian.com/browse/BCLOUD-14683

If you want to restrict access only to Bitbucket IPs, the IP addresses used for Bitbucket Cloud webhook delivery are listed below in the Outgoing Connections section:

• https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/#Outgoing-Connections

Is the delivery of the webhook successful? You can check the following troubleshooting guide:

• https://confluence.atlassian.com/bbkb/troubleshoot-webhooks-1167729092.html

If you enable history for the webhook and then perform an action that triggers the webhook, what is the status code for this event? If you select View details next to the status code, what response do you see from your server and do you get the body of the request?

Kind regards,
Theodora