Bitbucket Cloud Pipeline IP Whitelisting

[victor.mancipe]

I have set up a CI/CD pipeline in Bitbucket that deploys some artifacts to external servers which require an IP whitelisting in order to be reachable. I found this article (in particular the Atlassian IP ranges section) on the Atlassian official documentation that lists the bitbucket outbound IPs to whitelist.

This did not work as the remote systems are still unreachable even though we have whitelisted Bitbucket's IPs per instructions.

There is this troubleshooting article on the matter that provides a command to run within the pipelines to find out the actual IP used by the build. It seems like IP is not consistent across runs as I got 44.202.220.85 in the first execution and 44.203.77.136 the second time. Surprisingly neither of the IPs in the results are listed in the whitelisting article which is confusing.

Am I missing anything?

Any help will be appreciated.

[Ben]

Hi Victor!

As mentioned in our documentation - regular steps utilising 1x/2x step size will use a variety of Amazon Cloudfront IP addresses that can be found in this exhaustive list:

• https://ip-ranges.amazonaws.com/ip-ranges.json

You can filter this list down to us-east/us-west with the following command - all of these filtered addresses will need to be whitelisted:

curl https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.region=="us-east-1") | select(.service=="EC2") | .ip_prefix' 

curl https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.region=="us-west-2") | select(.service=="EC2") | .ip_prefix' 

Please let me know if further clarification is needed.

Cheers!

- Ben (Bitbucket Cloud Support)