IP addresses to allowlist in your corporate firewall

Using SSH to commit from behind a corporate firewall may require your network administrator to make specific network configuration changes to permit SSH connectivity from your computer to Bitbucket. Every network configuration is different, so we cannot give you detailed instructions. Bitbucket uses the standard ports for HTTP/HTTPS/SSH which are 80/443/22.

Bitbucket Cloud uses Amazon's CloudFront CDN to deliver static content. The IP address ranges used by CloudFront edge servers can be found in the Amazon CloudFront developer guide.

Valid IP addresses for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

Atlassian Cloud public IP ranges, including Bitbucket Cloud, are documented in Atlassian cloud IP ranges and domains. You can also can find a machine consumable list at https://ip-ranges.atlassian.com/. However, if you require a smaller list that is specific to Bitbucket, use the following:

IPv4 inbound for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

• 104.192.136.0/21

• 185.166.140.0/22

• 18.205.93.0/25

• 18.234.32.128/25

• 13.52.5.0/25

IPv6 inbound for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

• 2401:1d80:3204::/64

• 2401:1d80:3204:1::/64

• 2401:1d80:3204:2::/64

• 2401:1d80:3208::/64

• 2401:1d80:3208:1::/64

• 2401:1d80:3208:2::/64

• 2401:1d80:3210::/64

• 2401:1d80:3210:1::/64

• 2401:1d80:3210:2::/64

• 2401:1d80:3214::/64

• 2401:1d80:3214:1::/64

• 2401:1d80:3214:2::/64

• 2401:1d80:321c::/64

• 2401:1d80:321c:1::/64

• 2401:1d80:321c:2::/64

• 2401:1d80:3220::/64

• 2401:1d80:3220:1::/64

• 2401:1d80:3224::/64

• 2401:1d80:3224:1::/64

• 2401:1d80:3224:2::/64

• 2406:da00:ff00::22cd:e0db

• 2406:da00:ff00::6b17:d1f5

• 2406:da00:ff00::3403:4be7

• 2406:da00:ff00::22c3:9b0a

• 2406:da00:ff00::22c5:2ef4

• 2406:da00:ff00::22c2:0513

• 2406:da00:ff00::34cc:ea4a

• 2406:da00:ff00::22e9:9f55

• 2406:da00:ff00::22c0:3470 

• 2406:da00:ff00::34c8:9c5c

• 2406:da00:ff00::12d0:47c8

• 2406:da00:ff00::22ed:a9a3

• 2406:da00:ff00::23a8:5071

• 2406:da00:ff00::36ec:9434

• 2406:da00:ff00::3416:7161

• 2406:da00:ff00::36ec:bea6

• 2406:da00:ff00::12cd:ae3d

• 2406:da00:ff00::12cc:b432 

• 2406:da00:ff00::1714:aa06

• 2406:da00:ff00::342d:4312

• 2406:da00:ff00::22ee:e721

• 2406:da00:ff00::34cf:03c4

• 2406:da00:ff00::3657:a859

• 2406:da00:ff00::1716:0c22

• 2406:da00:ff00::36ec:507a

• 2406:da00:ff00::3448:67ee

• 2406:da00:ff00::36ad:fb4d

• 2406:da00:ff00::22ce:9394

• 2406:da00:ff00::12d0:5d6e

• 2406:da00:ff00::3402:732e

• 2406:da00:ff00::36d1:8b98

• 2406:da00:ff00::3414:6492

• 2406:da00:ff00::3437:b4cb

• 2406:da00:ff00::22e2:3a76

• 2406:da00:ff00::34c9:c443

• 2406:da00:ff00::3405:6cad

• 2406:da00:ff00::12ea:0a19

• 2406:da00:ff00::23a8:6621

• 2406:da00:ff00::3401:9341

• 2406:da00:ff00::3654:c786

• 2406:da00:ff00::3448:4e57

• 2406:da00:ff00::36a4:e08c

• 2406:da00:ff00::36a4:f8a6

• 2406:da00:ff00::22c8:ada3

• 2406:da00:ff00::34cd:a4b9

• 2406:da00:ff00::23a8:b9b1

• 2406:da00:ff00::3402:affc

• 2406:da00:ff00::12cd:d438

• 2406:da00:ff00::34ce:b43b

• 2406:da00:ff00::342d:1804

• 2406:da00:ff00::36ae:07e7

• 2406:da00:ff00::3456:314c

• 2406:da00:ff00::36af:42a0

• 2406:da00:ff00::3414:0248

Valid IP addresses for Bitbucket Pipelines build environments

You can use these IP ranges to allowlist requests made from your build environments. SSH keyscans are also performed from within the build environment. Note that Bitbucket Pipelines is a shared service and the IP addresses below are used for builds configured by all of our customers. In addition to IP allowlisting, you should use a secure means of authentication for any services exposed to Bitbucket Pipelines.

IPv4 outbound

• 34.199.54.113/32

• 34.232.25.90/32

• 34.232.119.183/32

• 34.236.25.177/32

• 35.171.175.212/32

• 52.54.90.98/32

• 52.202.195.162/32

• 52.203.14.55/32

• 52.204.96.37/32

• 34.218.156.209/32

• 34.218.168.212/32

• 52.41.219.63/32

• 35.155.178.254/32

• 35.160.177.10/32

• 34.216.18.129/32

• 3.216.235.48/32

• 34.231.96.243/32

• 44.199.3.254/32

• 174.129.205.191/32

• 44.199.127.226/32

• 44.199.45.64/32

• 3.221.151.112/32

• 52.205.184.192/32

• 52.72.137.240/32

Valid IP addresses for webhook delivery

To ensure Bitbucket webhooks are delivered successfully to the destination URLs you configured, add the IP address ranges we use for outgoing connections to the internet made on your behalf to your allow list. The exact list of IPs is in the Outgoing Connections section of the Atlassian cloud IP ranges and domains page.

Valid IP addresses for AWS ECR authentication (with Docker images)

To ensure your authentication of AWS ECR works properly when running a Pipelines build with Docker images, add the IP address ranges we use from the following list: Atlassian cloud IP ranges for AWS ECR.