Hello Community,
I have an issue with a connection between Dataform in GCP to Bitbucket private projects which is working only with whitelisted IPs. I have 2 GCP projects and the mentioned Bitbucket private workspace. I have successful configuration with Dataform in project A via SSH, but I get the following error in project B via Developer connect:
Invalid resource state for “projects/project-b/locations/europe-west3/secrets/bitbucketCloudApiToken-21wfz/versions/latest”: failed to verify authorizer token: Get “https://api.bitbucket.org/2.0/repositories/elena-ws/repository-elena-ws/hooks”: generic::permission_denied: 403: To access this repository, an admin must whitelist your IP.
Dataform in GCP is part of Big Query, checked the GCP documentation where I found an IP range for Dataform for Frankfurt 3 and whitelisted it in BB, also double-checked for Big Query limitations, but according the documentation, it does not have specific IP ranges.
The IP ranges for IPv4 inbound for bitbucket. org, api.bitbucket. org, and altssh.bitbucket .org are whitelisted. There are no VPCs, Cloud NATs or additional limitation from the GCP project.
The token has permissions per documentation. Via the tests, the authorization one needed repository:admin and the read one needed webhook, both were granted to both API tokens, and even with the additional permissions I still get that error.
For the test, I tried to add new repository connection in Dataform from project A, where we already have established SSH connection for another repository, but the result was the same. My question is:
- What should I whitelist more? I also did CURL of the hooks API, just to check the IPs behind, but it’s already whitelisted because it matches the given from BB range.
- Could it be a bug of BB related with the whitelist restriction? I created a test workspace, without that option and it works as expected.
Thank you in advance!
Best Regards,
Elena