Bitbucket OIDC IP range for new runtimes
Asked by Stuart Swain:

#### ++Summary++ {#toc-hId-347573843}

We are currently using OIDC to auth into AWS from Bitbucket Pipelines (cloud).

We have been using a trust policy similar to the one described in section:

**Allowing only requests from Bitbucket Pipelines IP range to assume the role**

on [this](https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/) page, and this has been working fine for months.

Testing on the new 4x CI/CD runtime size, however, fails with the following error despite (supposedly) having all the correct Bitbucket IP addresses specified:

```
Error: No valid credential sources found
```

#### ++Detail++ {#toc-hId--1459880620}

[This blog post](https://bitbucket.org/blog/announcing-our-new-ci-cd-runtime-with-up-to-8x-faster-builds) talks about the new runtimes available.

It also talks about 'Retirement of legacy runtime and IP changes', and that you should "... \[conduct\] some basic end-to-end testing of your `1x` and `2x` builds on the new `4x` build size prior to September 17th".

In accordance with this, we have tested our current pipelines by setting 'size: 4x' in steps that connect to AWS, but are seeing the error shown in the summary section above.

The above-mentioned blog post also states the following:
> If you use IP allowlisting to control access to your internal networks from Pipelines, please update to the new IP address ranges for the new runtime as listed in the [Pipelines documentation](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/) prior to September 17th.

...however, the trust policy for our OIDC deployment role already has the IP addresses listed in the section 'atlassian-ip-ranges' - specifically those that follow:

```
34.199.54.113/32
34.232.25.90/32
34.232.119.183/32
34.236.25.177/32
35.171.175.212/32
52.54.90.98/32
52.202.195.162/32
52.203.14.55/32
52.204.96.37/32
34.218.156.209/32
34.218.168.212/32
52.41.219.63/32
35.155.178.254/32
35.160.177.10/32
34.216.18.129/32
3.216.235.48/32
34.231.96.243/32
44.199.3.254/32
174.129.205.191/32
44.199.127.226/32
44.199.45.64/32
3.221.151.112/32
52.205.184.192/32
52.72.137.240/32
```

#### ++Question++ {#toc-hId-1027632213}

Are we missing something obvious here? Or is the IP address range provided in the 'atlassian-ip-ranges' secion on [this](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/) page incomplete?


Answers:
author: Ben
body: Hi Stuart,

The documentation is in the process of being updated as it is not made exactly clear how to ensure that your 4x/8x pipeline builds use only the IP addresses within the **atlassian-ip-ranges list**that you've mentioned.

You will need to modify your YML configuration as per [this article](https://support.atlassian.com/bitbucket-cloud/docs/step-options/#Runtime) as follows:

#### Example - using the runtime globally to enable atlassian-ip-ranges for all 4x, 8x steps {#toc-hId-347606524}

```
`options:``  runtime:``    cloud:``      atlassian-ip-ranges: true`
```

#### Example - using the runtime to enable atlassian-ip-ranges for a particular step {#toc-hId--1459847939}

```
`pipelines:`
`  default:`
`    - step:`
`        size: 4x`
`        runtime:`
`          cloud:            atlassian-ip-ranges: true``        script:``          - echo "I use atlassian-ip-ranges"`
```

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

comments: author: Stuart Swain
body: Thanks Ben - will check it out.


author: Stuart Swain
body: Can confirm this has fixed the issue. Thanks.


author: Ben
body: Awesome news [@Stuart Swain](/t5/user/viewprofilepage/user-id/5131380) !

Thank you for keeping us posted :)

Cheers!

- Ben (Bitbucket Cloud Support)


Tags: bitbucket-cloud

cloud