Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Bitbucket OIDC IP range for new runtimes

Stuart Swain June 30, 2024

Summary

We are currently using OIDC to auth into AWS from Bitbucket Pipelines (cloud).

We have been using a trust policy similar to the one described in section:

Allowing only requests from Bitbucket Pipelines IP range to assume the role

on this page, and this has been working fine for months. 

Testing on the new 4x CI/CD runtime size, however, fails with the following error despite (supposedly) having all the correct Bitbucket IP addresses specified:

Error: No valid credential sources found

Detail

This blog post talks about the new runtimes available.

It also talks about 'Retirement of legacy runtime and IP changes', and that you should "... [conduct] some basic end-to-end testing of your 1x and 2x builds on the new 4x build size prior to September 17th".

In accordance with this, we have tested our current pipelines by setting 'size: 4x' in steps that connect to AWS, but are seeing the error shown in the summary section above.

The above-mentioned blog post also states the following: 

If you use IP allowlisting to control access to your internal networks from Pipelines, please update to the new IP address ranges for the new runtime as listed in the Pipelines documentation prior to September 17th.

...however, the trust policy for our OIDC deployment role already has the IP addresses listed in the section 'atlassian-ip-ranges' - specifically those that follow:

34.199.54.113/32
34.232.25.90/32
34.232.119.183/32
34.236.25.177/32
35.171.175.212/32
52.54.90.98/32
52.202.195.162/32
52.203.14.55/32
52.204.96.37/32
34.218.156.209/32
34.218.168.212/32
52.41.219.63/32
35.155.178.254/32
35.160.177.10/32
34.216.18.129/32
3.216.235.48/32
34.231.96.243/32
44.199.3.254/32
174.129.205.191/32
44.199.127.226/32
44.199.45.64/32
3.221.151.112/32
52.205.184.192/32
52.72.137.240/32

 Question

Are we missing something obvious here? Or is the IP address range provided in the 'atlassian-ip-ranges' secion on this page incomplete?

1 answer

1 accepted

0 votes
Answer accepted
Ben
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
July 1, 2024

Hi Stuart,

The documentation is in the process of being updated as it is not made exactly clear how to ensure that your 4x/8x pipeline builds use only the IP addresses within the atlassian-ip-ranges list that you've mentioned.

You will need to modify your YML configuration as per this article as follows:

Example - using the runtime globally to enable atlassian-ip-ranges for all 4x, 8x steps

options:
  runtime:
    cloud:
      atlassian-ip-ranges: true

Example - using the runtime to enable atlassian-ip-ranges for a particular step

pipelines:
default:
- step:
size: 4x
runtime:
cloud: atlassian-ip-ranges: true script: - echo "I use atlassian-ip-ranges"

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

Stuart Swain July 1, 2024

Thanks Ben - will check it out.

Stuart Swain July 2, 2024

Can confirm this has fixed the issue. Thanks.

 

Ben
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
July 2, 2024

Awesome news @Stuart Swain ! 

Thank you for keeping us posted :) 

Cheers!

- Ben (Bitbucket Cloud Support)

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
PRODUCT PLAN
PREMIUM
PERMISSIONS LEVEL
Product Admin
TAGS
AUG Leaders

Atlassian Community Events