To create a pre-receive hook in bitbucket for securing the AWS access keys and secret keys

[Sravan Kumar]

create a hook where it should restricts

• AWS IAM roles and policies do not grant permissive permissions (Least-privilege access by default)
• Secrets (private keys, system passwords, cloud access keys, etc.) are not embedded in code

I believe where i need to write custom script to invoke the notifications before i push code to bitbucket 

can anyone guide me in writing the script..?

[preygil2]

something like this for "secrets"

public class ExampleHook implements PreRepositoryHook<RepositoryHookRequest> {
 
    private ScmService scmService;


    public ExampleHook(@ComponentImport final ScmService scmService) {

        this.scmService = scmService; // injecting ScmService dependency
    }
    
    @Nonnull
    @Override
    public RepositoryHookResult preUpdate(@Nonnull PreRepositoryHookContext context,
                                          @Nonnull RepositoryHookRequest request) {
        request.getRefChanges().stream()
       .forEach(refChange -> scmService.getBulkContentCommandFactory(request.getRepository())
               .contents(new BulkContentCommandParameters.Builder(refChange.getToHash())
                       .sinceCommitId(refChange.getFromHash())
                       .build(), new BulkContentCallback() {
                               @Override
                               public void onFile(@Nonnull BulkFile file, @Nonnull InputStream content) {
                                    // check InputStream for patterns that you want to avoid
                                  // if found return RepositoryHookResult.rejected();
                               }
          }).call());
                
          return RepositoryHookResult.accepted();
    }

}