Using Atlassian System User Accounts for API-Triggered Backup Downloads: Is It Safe and Necessary?

Question

Dear Atlassian Community,

At my organization, there is the urge and need to use the Atlassian API to trigger an automated backup downloads for e.g. Jira, Confluence, etc.

The senior admin here insists that an Atlassian system user account is right for this purpose.

However, I am having some doubts.

First of all, as you might have noticed, the System User Accounts are poorly documented to say the least. Probably Atlassian have some reasons for this. I have experience with system accounts of other companies providing software solutions and I know this tends to be so.

Aren't system user accounts a bit of an overkill for something like creating a token for sending GET requests to the Atlassian API?

Are they safe to use via the API in general?

Aren't they like service accounts for only Atlassian staff to use? That's at least my understanding atm.

Kind regards,
Alex

Vish Reddy {Revyz} · Answer

Hi @Alexandrina Esti

Here is a good article on API security best practices - https://stackoverflow.blog/2021/10/06/best-practices-for-authentication-and-authorization-for-rest-apis/

While the article is dated, it still should serve as a good reference.

Hope this helps.

Alexandrina Esti · Answer

Good morning @Vish Reddy {Revyz} ,

That answer is far more satisfying than the other from Daria :) ;) ;)

Indeed, Atlassian also confirmed there isn't basically such thing currently on Cloud, that's some redundant and old term, used wrongly in the wrong context by the wrong people.

Well, the other thing that also worries me is, that API access has been given to that very Admin account which they call wrongly "Jira System User" account which is in fact simply a Jira Admin account and nothing more. It is in the site admins and jira admins groups.

What kind of potential security issues come to mind, when you see this? Is this "Best Practice"?

I will be awaiting your response. See you soon again!

Kind regards,
Alex

Vish Reddy {Revyz} · Answer

Hi @Alexandrina Esti

In the cloud as far as I am aware there is no concept of an Atlassian System User compared to Data Center / Server

Having said that if you are writing a script to trigger a backup, the best practice would be - to create a user account specifically for integrations or background tasks call this the "service account".

This account would have limited permissions assigned based on its intended purpose. This approach requires managing an additional user account, so consider the number of user licenses you have available.

The downside of this approach is that there is an API token being exchanged and you would be storing the token in a script somewhere in clear text. Depending on the security risk appetite of your organization that may or may not be acceptable for your organization.

Another alternative would be for you to create a private app which does what you are looking for except that the authentication mechanism would be a JWT.

You can find more information on the JWT here.