How to secure AWS credentials by Projects

Purushothaman_Anbazhagan

I have added AWS credentials in Bamboo for code deployment. This credentials is shared to all other deployment projects.

But, I want restrict only for certain deployment projects. How could I do that?

I checked this link, https://confluence.atlassian.com/bamboo/shared-credentials-424313357.html#Sharedcredentials-edit_shared_credentials

It says I could edit, add or delete the credentials. I want to make it available for only certain projects.

 

Steffen Opel [Utoolity]

I'm afraid Bamboo shared credentials do not support such granular scopes at this point - please watch and vote for the following issues to in increase Atlassian's priority for these improvements:

• As an admin I want to set AWS credentials at a project/plan level (BAM-17893)
• Limit access to bamboo shared credentials based on users groups (BAM-18370)

Potential workaround

Depending on your specific requirements, you may be able to work around the problem via user groups and a third-party app as follows:

1. Reuse/Create an appropriate group that restricts deployment permissions to applicable users as desired.
2. Rather than using Bamboo's native shared AWS credentials feature, you could use our (commercial) Identity Federation for AWS (Bamboo) app where you can scope AWS credentials by user group, which has the following benefits and constraints:

• Disclaimer: I'm a co-founder of the app's creator Utoolity.
• If you use the same group as in 1. when configuring the AWS Connector, you effectively limit user access to the AWS credentials in question as desired (but see below).
  • Note that builds and deployments are usually executed without an active user session, which is why you need to assign System scope to allow connector usage from elevated code. Users without access to a connector can execute resp. builds/deployments, but cannot access the underlying AWS credentials directly (see below).
• The app also creates temporary AWS security credentials rather than using the long-term AWS credentials directly (the latter is strongly discouraged from an IAM security best practices point of view).
• You can inject these temporary AWS credentials into other tasks as outlined on Using the AWS Credentials Variables task in Bamboo and How to provide temporary AWS credentials to the AWS Command Line Interface (AWS CLI) via Bamboo variables.