What is the best practice to give permission to bitbucket to access aws

[t1279k]

Currently I use bitbucket pipeline for application deployment ( to ECS,EKS,S3,EC2, etc..) and also have pipelines used to deploy terrafrom script to maintain aws infrastructure. 

How do most assign permissions to bitbucket to access aws? Do most of you create as services user with admin permissions and add AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to workspace variable.  Is there a better/more secure way to do this?

[Saxea _Flowie_]

Hi @t1279k

Using OpenID Connect would be a more secure way to do this:

https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

https://intelligentpathways.com.au/deploying-to-aws-using-bitbucket-pipelines/