IPv4 addresses used for Bitbucket pipeline different from the documented IP ranges

Question

Hi,

We have a list of 24 IPv4 Addresses(as stated here) added to our corporate whitelist in order to access systems on the build pipeline The pipeline has functioned without issue for many years but we just found that the pipeline started failing due to unauthorised IP recently. When we printed the IP using the curl ifconfig.me command, it seems to be using the fresh set of IP addresses that isn't mentioned anywhere in the bitbucket cloud documentation.

Has the list of IP ranges changed with new IP addresses added or the current ones deprecated?

Any insights on this would be helpful.

Thanks

Theodora Boudale · Answer

You are very welcome, Nikhil. Please feel free to reach out if you ever need anything else!

Nikhil Lakshmisha · Answer

Thanks for your reply, Theodora.

Theodora Boudale · Answer

Hi Nikhil and welcome to the community.

We recently updated our 1x/2x size option builds to operate from new, broader IP ranges.

The documentation of Bitbucket Pipelines Cloud IP addresses is divided into two sections:

* Section 1: Valid IP addresses for Bitbucket Pipelines build environments

This section applies to 1x/2x step sizes (and 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges). An exhaustive list of IP addresses from which the traffic may originate on AWS can be obtained by using the following endpoint. You should filter records where the service equals EC2 or S3, and focus on the us-east-1 and us-west-2 regions. However, we do not recommend using these IP ranges as a security control due to their broad nature.

* Section 2: Atlassian IP Ranges

This section pertains to steps specifically configured to use Atlassian IP ranges. These are applicable only to 4x and 8x size steps that have the atlassian-ip-ranges: true flag enabled. The step sizes 4x and 8x are only available for builds running under a paid Bitbucket Cloud plan (Standard or Premium).

For teams who need their builds to run from a more restricted set of IP addresses, we recommend using this option. This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list.

Please Note: Opting for larger step sizes (4x/8x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

I hope this helps. Please let me know if you have any additional questions.

Kind regards,
Theodora