Bitbucket OIDC IP range for new runtimes

[Stuart Swain]

Summary

We are currently using OIDC to auth into AWS from Bitbucket Pipelines (cloud).

We have been using a trust policy similar to the one described in section:

Allowing only requests from Bitbucket Pipelines IP range to assume the role

on this page, and this has been working fine for months. 

Testing on the new 4x CI/CD runtime size, however, fails with the following error despite (supposedly) having all the correct Bitbucket IP addresses specified:

Error: No valid credential sources found

Detail

This blog post talks about the new runtimes available.

It also talks about 'Retirement of legacy runtime and IP changes', and that you should "... [conduct] some basic end-to-end testing of your 1x and 2x builds on the new 4x build size prior to September 17th".

In accordance with this, we have tested our current pipelines by setting 'size: 4x' in steps that connect to AWS, but are seeing the error shown in the summary section above.

The above-mentioned blog post also states the following: 

If you use IP allowlisting to control access to your internal networks from Pipelines, please update to the new IP address ranges for the new runtime as listed in the Pipelines documentation prior to September 17th.

...however, the trust policy for our OIDC deployment role already has the IP addresses listed in the section 'atlassian-ip-ranges' - specifically those that follow:

34.199.54.113/32
34.232.25.90/32
34.232.119.183/32
34.236.25.177/32
35.171.175.212/32
52.54.90.98/32
52.202.195.162/32
52.203.14.55/32
52.204.96.37/32
34.218.156.209/32
34.218.168.212/32
52.41.219.63/32
35.155.178.254/32
35.160.177.10/32
34.216.18.129/32
3.216.235.48/32
34.231.96.243/32
44.199.3.254/32
174.129.205.191/32
44.199.127.226/32
44.199.45.64/32
3.221.151.112/32
52.205.184.192/32
52.72.137.240/32

 Question

Are we missing something obvious here? Or is the IP address range provided in the 'atlassian-ip-ranges' secion on this page incomplete?

[Ben]

Hi Stuart,

The documentation is in the process of being updated as it is not made exactly clear how to ensure that your 4x/8x pipeline builds use only the IP addresses within the atlassian-ip-ranges list that you've mentioned.

You will need to modify your YML configuration as per this article as follows:

Example - using the runtime globally to enable atlassian-ip-ranges for all 4x, 8x steps

options:
  runtime:
    cloud:
      atlassian-ip-ranges: true

Example - using the runtime to enable atlassian-ip-ranges for a particular step

pipelines:
  default:
    - step:
        size: 4x
        runtime:
          cloud:
            atlassian-ip-ranges: true
        script:
          - echo "I use atlassian-ip-ranges"

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

[Stuart Swain]

Thanks Ben - will check it out.