Bitbucket pipeline - Build Artifact RSYNC step failing due to Connection Timeout

SRIVENKATESH VASIRAJU

Bitbucket Account type: Academic (Free-tier Account)

We are trying to deploy a node-js web-service to our EC2 instance and have had success in doing so for a while using bitbucket pipelines. But recently, the pipeline fails at the RSYNC step (step 1), where we try to deploy the build artifact to our instance from the bitbucket pipeline container using pipe:atlassian/rsync-deploy:0.13.0. After updating our security group in-bound rules with the IPs listed in the section "Valid IP addresses for Bitbucket Pipelines build environments" at the link, the pipeline still failed.

Then we tried to get the public IP of the container using curl ifconfig.me from with in the pipeline step. This revealed the IP Address 18.206.244.222.

After updating our security group rules with the above IP, the pipeline succeeded.

We are trying to figure out what the correct set of IPs are for us to include in our corporate firewall, since 18.206.244.222 is clearly not listed at the link.

Any help on this would be greatly appreciated. Thanks!

Theodora Boudale

Hi and welcome to the community!

Can you please confirm if the Pipelines step that does the deployment runs on Atlassian's infrastructure? If so, we migrated 1x- and 2x-size build steps to a new runtime and they now operate from new, broader IP ranges.

The IP ranges listed in the section "Atlassian IP ranges" of the documentation you shared are used only by steps of size 4x or larger that have the atlassian-ip-range flag:

• https://support.atlassian.com/bitbucket-cloud/docs/step-options/#Runtime

This option will work only if your workspace is on the Standard or Premium plan.

 

In all other cases, the following applies (I am quoting from the same documentation page you linked in your post):

The machines that execute all steps on Atlassian Cloud Infrastructure, not just steps opted into atlassian-ip-ranges ranges, are hosted on Amazon Web Services. SSH keyscans are also performed from within this environment.

An exhaustive list of IP addresses that the traffic may come from on AWS can be found by using the following endpoint, filtering to records where the service equals EC2 or S3, and using the us-east-1 and us-west-2 regions.

So, you will need to check this list:

• https://ip-ranges.amazonaws.com/ip-ranges.json

and filter to records where the service equals EC2 or S3, and using the us-east-1 and us-west-2 regions, and allowlist these IP ranges.

Important Note: The IP addresses provided via this endpoint are managed by Amazon and are subject to change. We recommend regularly checking this endpoint and updating your firewall's IP list accordingly. Additionally, consider exploring automation options to streamline updating IPs in response to changes.

Please feel free to reach out if you have any questions.

Kind regards,
Theodora