Bitbucket pipelines failing with Unable to access admin must whitelist your IP

[Divya Naidu]

Pipelines are failing with the error To access this repository admin must whitelist your IP.

[Theodora Boudale · Accepted solution]

Hi Divya,

The error message indicates that your workspace is using the IP allowlisting feature available on the Premium plan.

We have recently updated our 1x/2x size option builds to operate from new, broader IP ranges.

The documentation of Bitbucket Pipelines Cloud IP addresses is divided into two sections:

• Section 1: Valid IP addresses for Bitbucket Pipelines build environments
  
  This section applies to 1x/2x step sizes (or 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges). An exhaustive list of IP addresses from which the traffic may originate on AWS can be obtained by using the following endpoint. You should filter records where the service equals EC2 or S3, and focus on the us-east-1 and us-west-2 regions. However, we do not recommend using these IP ranges as a security control due to their broad nature.
  
  

• Section 2: Atlassian IP Ranges
  
  This section pertains to steps specifically configured to use Atlassian IP ranges. These are applicable only to 4x and 8x size steps that have the atlassian-ip-ranges: true flag enabled. The step sizes 4x and 8x are only available for builds running under a paid Bitbucket Cloud plan (Standard or Premium).
  
  For teams who need their builds to run from a more restricted set of IP addresses, we recommend using this option. This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list. 
  
  Please Note: Opting for larger step sizes (4x/8x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

I hope this helps. Please let me know if you have any additional questions.

Kind regards,
Theodora

[Divya Naidu]

Hi Theodora,

Thank you for the reponse!

I've whitelisted all the IPv4 and IPv6 mentioned in the document provided. The issue still persists.

I have tried to trace down the IP it is trying to fetch from and I got 3 IPs which were not mentioned in the document provided. (I tried 3 times got 3 new IPs all 3 times)
IPs: 44.195.21.20, 44.199.228.106, 44.202.64.137.

Are there any IPs missed in the document?

Please refer the issue in the screenshot.

[Theodora Boudale]

Hi Divya,

If we are talking about Section 1 of the documentation that I listed in my reply above, then this endpoint https://ip-ranges.amazonaws.com/ip-ranges.json has CIDR blocks, so you most likely won't find the exact IP addresses listed there. You can use the following site to confirm if a certain IP address is from AWS and which subnet it belongs to:

• https://thameera.com/awsip/

The IP in your screenshot, 44.202.64.137, belongs to the subnet 44.192.0.0/11. This subnet is listed in https://ip-ranges.amazonaws.com/ip-ranges.json, the service for this subnet is EC2 and the region is us-east-1, so this is consistent with our documentation. This is the case for the other two IPs you provided as well.

If you don't use a 4x or 8x size step with the atlassian-ip-ranges: true flag enabled, then the traffic will come by IPs from the subnets in this endpoint, filtering records where the service equals EC2 or S3, and focusing on the us-east-1 and us-west-2 regions. We do not recommend whitelisting all these IP ranges due to their broad nature.

The recommended option, if you want your Pipelines step to use the more restrictive set of IPs listed in Atlassian IP Ranges, is to use a 4x or 8x size step with the atlassian-ip-ranges: true flag enabled.

Please feel free to let me know if you have any questions.

Kind regards,
Theodora