Pipeline started failing in cdk deploy

[Fabian Glawe]

We have a Pipeline in place to deploy to AWS. We are now using it for around 1–2 Years without any major changes to the pipeline (sometimes a runtime update or so).

Starting one week ago, the pipeline always fails in the "cdk deploy" step with the error:

"Unable to resolve AWS account to use. It must be either configured when you define your CDK Stack, or through the environment"

First we thought it was related to the change in IP addresses used, but after updating the role in the AWS Account we still got the same issue.

Anyone experience something like this and maybe already knows a fix for it?

[Fabian Glawe · Accepted solution]

I was just able to resolve the issue with removing the whitelisting of the IP-Addresses in the AWS IAM Role.

[Theodora Boudale]

Hi Fabian,

In case you do want to use whitelisting, we have recently updated our 1x/2x size option builds to operate from new, broader IP ranges.

For teams who need their builds to run from a more restricted set of IP addresses, we recommend using the atlassian-ip-ranges configuration available with our 4x/8x steps. This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list. You can find more details about this configuration here. This configuration does not need to apply to all steps in a pipeline, just the steps that access secure resources.

Please Note: Opting for larger step sizes (4x/8x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

You can view the complete list of IP addresses used by the 1x/2x steps (or 4x/8x steps that have not been explicitly flagged to use atlassian-ip-ranges) in this JSON format. This list can be explicitly filtered for EC2 or S3 resources located in us-east-1 and us-west-2. We do not recommend or support adding these IP addresses into your firewall configuration.

Important Note: Relying solely on IP-based firewalls for securing your infrastructure is not recommended. Instead, consider implementing secure authentication methods for any services exposed to Bitbucket Pipelines, such as using OpenID Connect (OIDC).

I hope this helps. Please let me know if you have any additional questions.

Kind regards,
Theodora