Advice on secure way to integrate to confluence

[Cliff Dias]

Hi all,

I've raised this to seek advice on a solution I am working on.

My team is building a self service capability that integrates to Jira Service Desk and Confluence.

Our Confluence and JSD instances are on premise. This will change in time, but not in the near future. We do not want to create another confluence instance. There are cost/licencing implications that we want to keep low.

The Confluence instance has content from various sources some of this is sensitive information. The data is split into spaces and permissioned according to Data Classification rules. The Confluence pages we want to access are in a specific space.

The solution we are building uses the REST API to create tickets and read confluence data. The access to confluence data is restricted to a specific Space. i.e the REST API will only be called for that space. We also use page permissions authorising read access.

The application is running in AWS and we have network rules to restrict traffic to the Jira servers to the specific AWS VPC.

From a solution perspective, is there anything we can do to improve security so that sensitive information is not leaked ?