IP Whitelisting for Bitbucket Repo

[chetan_rana]

I understand that Bitbucket Premium offers IP whitelisting for Private Repo. I want to understand if this IP whitelisting only applies to developers accessing the repo or even the pipeline (system to system access) accessing repo. 

[Theodora Boudale]

Hi @chetan_rana and welcome to the community!

IP whitelisting applies to accessing the repo from the website and also Git operations, like cloning, pulling, pushing. This means it also applies to Pipelines, as Pipelines clone the repo at the beginning of each step (unless you have disabled cloning for a step).

If you enable IP Whitelisting in a Premium workspace and you run Pipelines builds in its repos, you'll need to add in IP allowlisting the IP ranges used by Pipelines build environments.

All Pipelines steps are executed from the ranges listed below, filtering to records where the service equals EC2 or S3, and using the us-east-1 and us-west-2 regions.

• https://ip-ranges.amazonaws.com/ip-ranges.json

However, we do not recommend using these IP ranges as a security control due to their broad nature.

Pipelines steps with a size of 4x or larger can be configured to use a more limited set of IP ranges, that are listed here:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/#Atlassian-IP-ranges

The bitbucket-pipelines.yml file needs to be adjusted to opt a step in the more limited set, as follows:

pipelines:
  default:
    - step:
        size: 4x
        runtime:
          cloud:
            atlassian-ip-ranges: true
        script:
          - echo "This step will use atlassian-ip-ranges"

The documentation below has an example on how to configure this for all steps of a pipeline:

• https://support.atlassian.com/bitbucket-cloud/docs/global-options/#Runtime

Please Note: Opting for larger step sizes (4x/8x/16x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

Please feel free to reach out if you have any questions!

Kind regards,
Theodora