How to interact from Jira Cloud to an on-premise system when using plugins like ScriptRunner?

[hans.polder]

So, the challenge is:

• We have some on-premise tooling that we want our new Jira Cloud to connect to
• We have an endpoint set-up for this in a DMZ (to go from Cloud to On-Prem), but that still requires whitelisting for IPs that want to send traffic
• We did whitelist the IP ranges from Atlassian and we thought we were all set
• Until we created and tested our ScriptRunner script in Jira Cloud to connect to that endpoint. It didn't work. It looks like the IP address initiating the traffic is not Atlassian Cloud, but ScriptRunner itself. 
• And, ScriptRunner is not running on fixed ranges, they just say "whitelist entire Amazon zones 1 and 2"

So: 

How can we get our usecase to work, where changes for certain tickets (like status updates, comments) are sent to our on-prem tool without having to whitelist all IP ranges from ScriptRunner? 

Also curious about this for any future plugin. I would feel it would make more sense to always have Atlassian IP ranges initiate the traffic and that the plugin vendor has to take care of their initial solid connection with Atlassian Cloud.

Thanks for any help/thoughts!

[Ram Kumar Aravindakshan _Adaptavist_]

Hi @hans.polder

Welcome to the community.

For your requirement, getting the details from the on-premise instance in the Cloud instance may be possible via REST.

You could configure a REST Endpoint using ScriptRunner for Jira Server / DC on your on-premise instance and invoke that REST Endpoint via your cloud.

I hope this helps to answer your question. :-)

Thank you and Kind regards,

Ram

[hans.polder]

@Ram Kumar Aravindakshan _Adaptavist_ , thanks for your reply! We are already beyond that point :) We already have an API exposed on the target system and it's reachable via the internet.

However, the issue being that before connections can be set-up to that endpoint, the source IP's need to be whitelisted, since our endpoint doesn't accept calls from non-whitelisted IP's.

I was surprised to learn that, apparently, doing calls via Scriptrunner towards our endpoint is actually going over Scriptrunner IP's/servers rather than using the source IPs from Atlassian themselves.