What level of Admin role is needed for Operations Terraform Provider?

[Sören König]

Hi I am trying to use the Terraform provider to programmatically manage Atlassian Operations / Jira Service Management (Cloud). I want to create a dedicated user for issuing the necessary API token and to adhere to the principle of least privilege, I wanted to know what level of admin role this dedicated user would need to create the resources the provider supports. The docs of the Terraform provider only state "This must be an admin account." [1].

I read on https://support.atlassian.com/jira-service-management-cloud/docs/work-with-operations-global-admin/ that there are two types in JSM: Product admin and Operations global admin. So my question is: What admin role does the user who issues the API token for the Terraform provider need to have?

Thanks in advance!

[Christos Markoulatos]

I’m not familiar with Terraform, but from what I understand, if you want to use the Terraform provider to manage Jira Service Management Cloud, especially the operational features like teams, alerts, schedules, and integrations, the API token you use must come from a user with admin privileges for those operations. There are two roles that qualify, Operations Global Admin that can manage operational features within Jira Service Management Cloud such as teams, alerts, schedules, and integrations and Jira Product Admin that has all the Operations Global Admin permissions plus full admin rights across Jira.

Because as far i can tell Terraform manages operational resources, the user needs to be at least an Operations Global Admin. Having Jira Product Admin rights also works but gives more access than necessary.

Also, API tokens reflect the permissions of the user who created them. There aren’t special system tokens, so the best practice is to create a dedicated service account with the proper admin role and use its API token. Keep in mind that API tokens expire after one year, so you’ll need to rotate them regularly.

Hope this helps!