Need to verify IP Range list to Whitelist BitBucket on AWS

Question

Here's what I came up with - PLEASE help me verify!

1) IPv4 inbound for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

* 104.192.136.0/21

* 185.166.140.0/22

* 13.200.41.128/25

2) IPv6 inbound for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

* 2401:1d80:320c:3::/64

* 2401:1d80:320c:4::/64

* 2401:1d80:320c:5::/64

* 2401:1d80:3208::/64

* 2401:1d80:3208:1::/64

* 2401:1d80:3208:2::/64

* 2401:1d80:3210::/64

* 2401:1d80:3210:1::/64

* 2401:1d80:3210:2::/64

* 2401:1d80:321c::/64

* 2401:1d80:321c:1::/64

* 2401:1d80:321c:2::/64

* 2401:1d80:322c:2::/64

* 2401:1d80:322c:3::/64

* 2401:1d80:322c:5::/64

* 2401:1d80:3218:1::/64

* 2401:1d80:3218:3::/64

* 2401:1d80:3218:4::/64

* 2401:1d80:3220::/64

* 2401:1d80:3220:1::/64

* 2401:1d80:3224::/64

* 2401:1d80:3224:1::/64

* 2401:1d80:3224:2::/64

3) Valid IP addresses for Bitbucket Pipelines build environments:

NOTE: Service: EC2, region: eu-central-1

35.50.192.0/24

18.96.32.0/19

3.5.136.0/22

18.192.0.0/15

136.18.142.0/23

64.252.89.0/24

63.176.0.0/14

99.77.136.0/24

5.60.32.0/22

15.145.2.0/23

63.180.0.0/14

52.58.0.0/15

15.220.48.0/21

18.184.0.0/15

52.57.0.0/16

35.96.12.0/24

54.93.0.0/16

3.124.0.0/14

35.96.96.0/20

15.220.64.0/20

3.33.35.0/24

52.95.255.128/28

83.119.128.0/18

15.220.152.0/21

18.156.0.0/14

15.220.144.0/23

35.96.48.0/20

64.252.87.0/24

15.145.0.0/23

99.77.158.0/24

35.50.194.0/24

3.64.0.0/12

151.148.35.0/24

15.145.12.0/22

99.77.247.0/24

64.252.88.0/24

35.50.193.0/24

52.29.0.0/16

99.151.188.0/23

15.193.4.0/24

99.150.16.0/21

3.120.0.0/14

18.198.0.0/15

52.94.248.112/28

35.96.5.0/24

35.156.0.0/14

5.60.24.0/22

15.145.16.0/22

15.145.4.0/23

18.153.0.0/16

173.83.196.0/23

64.252.86.0/24

18.196.0.0/15

52.95.248.0/24

52.94.146.0/24

18.89.0.0/18

18.194.0.0/15

52.46.184.0/22

35.71.105.0/24

52.28.0.0/16

15.145.8.0/22

3.5.134.0/23

15.177.68.0/23

Ben Lorenzo · Answer

I too am having a similar issue even after we whitelisted Atlassian IPs

My network admin asked "What specific bitbucket service are you using.  Is it pipelines?"  I answered yes and then sent me the information below regarding "OIDC"

Does this make sense? I'm not a network guy - Is this the direction I need to go?

++++++++++++++++++++++++++++++++++++++++++++++++

From https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/

Valid IP addresses for Bitbucket Pipelines build environments

The servers that execute all steps on Atlassian Cloud Infrastructure, are hosted on Amazon Web Services (AWS).

An exhaustive list of IP addresses that the traffic may come from on AWS can be found by using the following endpoint, filtering to records where the service equals EC2 or S3, and using the us-east-1 and us-west-2 regions. We do not recommend using these IP ranges as a security control.

If you prefer to use a more limited or narrowed IP range, you should utilize the atlassian-ip-ranges that are available in the new larger instances (4x and above).

As a reminder, Atlassian does not recommend configuring IP-based firewalls as the only mechanism to protect access to your infrastructure. As an example In addition to IP-based firewall rules, you should also use a secure means of authentication for any services exposed to Bitbucket Pipelines (e.g., by using OIDC).

Ok, looks like we need to dig further and implement this: https://support.atlassian.com/bitbucket-cloud/docs/integrate-pipelines-with-resource-servers-using-oidc/

++++++++++++++++++++++++++++++++++++++++++++++++++

Andrew Sheldon_0wxv3q · Answer

I am having similar issue.

We have added the Atlassian IP Address to our security group because we plan to use 4X build. But When I try to get the Known Host, I says there is a SSH error. Does the Known Host fetch not run through one of those IP addresses?

Thanks

Theodora Boudale · Answer

Happy new year to you too, @Budggy Inc.!

Thank you for the additional information!

The IP addresses for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org in your post seem to be the ones from our documentation.

However, the IP ranges for Pipelines environments in your post have Service: EC2, region: eu-central-1.

If you are not planning to use Atlassian IP ranges, then from the following endpoint you need to get the IP ranges where service equals EC2 or S3, and out of these, filter further on the us-east-1 and us-west-2 regions (not the eu-central-1 region).

* https://ip-ranges.amazonaws.com/ip-ranges.json

Please also keep in mind that when you try to fetch the fingerprint, you need to provide the public IP address or domain name of your server. Bitbucket will try to connect to your server over the internet in order to fetch the fingerprint (and also during the build), and private IP addresses can only be used in a local network.

Please feel free to let me know how it goes.

Kind regards,
Theodora