Pipeline using VPC endpoint or bitbucket account
Platform Notice: Cloud Only - This article only applies to Atlassian products on the cloud platform.
Summary
If the correct IPs configured under your corporate firewall are allowlist, check for these two possible issues:
AWS S3 resource is inaccessible from Pipelines
Or, the IP accessing the S3 resource may be different than the allowlisted IPs
Solution
When AWS tries to access a resource in the same region where Bitbucket Pipelines is running, it uses internal VCP tunneling. In this case, AWS internal private IPs are used for the connection instead of public IPs. Bitbucket does this to significantly increase the performance of caches and artifacts (among other things) and reduce build times.
Unfortunately, this also means that service requests don't come from the documented public IP ranges. The pipeline runs in either the us-east-1 or us-west-2 region based on the pipeline failover strategy.
To resolve this, you need to allow the below VPC IDs in their policy, which should fix the problem.
The VPC details used by Pipelines are as follows in the table:
Was this helpful?