Given the limitation of the access key that it doesn't require a passphrase and cannot be associated with an account. It can be the case that one still have the read access of the private repository after his/her account revoked. Or worse, the leaked private key can causes an unauthorised third party gains access to the private repository.
Is there a way to
?
Hi @Jin Yu Tung,
Thank you for reaching out to the community.
Right now, there's no feature to manage repository Access keys' by setting policies such as rotating it periodically, or set an expiration, or controlling the creation.
We do have an existing feature request similar to it that can be located through this link. - https://jira.atlassian.com/browse/BCLOUD-21080
You can upvote and watch it for now so that you'll be notified of any updates from our team when the feature becomes available on Bitbucket Cloud.
For now, you'll have to manually rotate repository Access keys periodically by removing and generating new SSH keys.
For the workflow recommendation, I would recommend using the user's personal SSH keys instead and then managing their read access to the specific repository or workspace user groups.
This way, whenever a user is revoked, the SSH key will also be revoked.
Hope it helps and do let me know if you have further questions.
Regards,
Mark C
Hi Mark C,
Is there a way to restrict a user from creating an access key currently?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi @Jin Yu Tung
Right now, only admins can create repository Access keys and there's no feature to restrict admins from creating an access key.
However, as long a user only has Read or Write access to the repository, they won't be able to create Access keys.
Let me know if you have further questions.
Regards,
Mark C
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Online forums and learning are now in one easy-to-use experience.
By continuing, you accept the updated Community Terms of Use and acknowledge the Privacy Policy. Your public name, photo, and achievements may be publicly visible and available in search engines.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.