Unknown New Bitbucket Pipeline IP Address
Asked by Jonathan Duncan:

I have a script that runs in Pipelines. It accesses a resource that is blocked by my load-balancers unless the request is from a known IP address. I have the lists of known Bitbucket IP addresses, so this request usually works. Today it stopped working and the IP that was reported is: \`44.198.171.117\`

Is this a new IP that has not made it onto the official lists? A \`whois\` shows that it belongs to Amazon.

That Address is not in any of the lists that I have found:

- <https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/#AtlassiancloudIPrangesanddomains-OutgoingConnections>

- <https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/>

- <https://ip-ranges.atlassian.com/>


Answers:
author: Syahrul
body: G'day,

We have recently [updated our 1x/2x size option builds](https://bitbucket.org/blog/migrating-pipelines-1-2x-steps-to-our-new-ci-cd-runtime) to operate from a new, [broader IP range](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/). To access the complete list of IP addresses, you can use [this endpoint](https://ip-ranges.amazonaws.com/ip-ranges.json) to filter results specifically for **EC2** resources located in **us-east1** and **us-west2**.

**Important Note:** The IP addresses provided via this endpoint are managed by Amazon and are subject to change. We recommend regularly checking this endpoint and updating your firewall's IP list accordingly. Additionally, consider exploring automation options to streamline updating IPs in response to changes.

![](https://getsupport.atlassian.com/images/icons/emoticons/information.png) If you require your builds to run from a more limited set of IP addresses, you must use the atlassian-ip-ranges runtime configuration available on **4x/8x steps** . This configuration is [documented here](https://support.atlassian.com/bitbucket-cloud/docs/step-options/#Runtime).

**Please Note:** Using larger step sizes may have billing implications. Please review the related documentation on step sizes that are [available here](https://support.atlassian.com/bitbucket-cloud/docs/step-options/#Size).

I hope this helps.   

Regards,  
Syahrul

comments: author: Jonathan Duncan
body: I searched for all of the IP addresses that myself and other commenters have specified on this thread. I did not find any of them listed at either of the endpoints that you mentioned:

- <https://ip-ranges.atlassian.com/>  
- <https://ip-ranges.amazonaws.com/ip-ranges.json>


author: Syahrul
body: Hey [@Jonathan Duncan](/t5/user/viewprofilepage/user-id/1170081)

You can use <https://thameera.com/awsip/> to check for the IPs subnet. It should give you the correct subnet that you can use to allowlist.

Regards,  
Syahrul


author: Zach Robert
body: Also confirming this - had a few users with deployment issues this morning, found the following 3 IPs being blocked as they weren't part of our Bitbucket Pipeline policy:

44.199.196.217  
44.211.80.122  
52.23.252.59

comments: author: Syahrul
body: Hey [@Zach Robert](/t5/user/viewprofilepage/user-id/5600544)

These IP addresses are part of the broader IP range listed at [AWS IP Ranges](https://ip-ranges.amazonaws.com/ip-ranges.json).

To verify the IP addresses you encounter and allowlist specific subnets, you can use [this tool](https://thameera.com/awsip/).

However, I recommend filtering for services equal to EC2 or S3 and focusing on the us-east-1 and us-west-2 regions.

Regards,  
Syahrul


author: Tim Spiekermann
body: I can confirm this.

We have rsync deployment problems since yesterday and are debugging right now. It seems, there are some new undocumented IP addresses in use:

3.231.55.79  
44.192.120.9

comments: author: Syahrul
body: Hey [@Tim Spiekermann](/t5/user/viewprofilepage/user-id/5599211)

These IP addresses are part of the broader IP range listed at [AWS IP Ranges](https://ip-ranges.amazonaws.com/ip-ranges.json).

To verify the IP addresses you encounter and allowlist specific subnets, you can use [this tool](https://thameera.com/awsip/).

However, I recommend filtering for services equal to EC2 or S3 and focusing on the us-east-1 and us-west-2 regions.

Regards,  
Syahrul


author: Tim Spiekermann
body: Thank you,

we are using atlassian-ip-range: true and size: x4 config now and it works.


author: Tim Spiekermann
body: See answer here:

<https://community.atlassian.com/t5/Bitbucket-questions/bitbucket-new-pipline-ip-address-list/qaq-p/2817058>

They are using a lot of AWS IP ranges per default now, but you can configure your x4/x8 pipeline with atlassian-ip-ranges: true.

Just tested it and it works (it does not without size: 4x)

comments: author: Corey Mohler
body: I tried adding that to my pipeline but I'm still getting new ips.


author: Renato Lima
body: There is this blog post regarding the change <https://bitbucket.org/blog/evolving-bitbucket-pipelines-to-unlock-faster-performance-and-larger-builds>


Tags: bitbucket-cloud

cloud