Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,462,323
Community Members
 
Community Events
176
Community Groups

Artifacts encryption

Are Bitbucket Pipleines artifacts encrypted at rest? I can't find any information about this in the documentation. I wonder what the best practice is when dealing with potentially sensitive artifacts (for example Terraform plan files, which might contain sensitive data in plain text).

1 answer

1 accepted

0 votes
Answer accepted
Caroline R Atlassian Team Oct 12, 2021

Hi, @Mark Hegedus! Welcome to the community! 

Bitbucket Cloud data at rest is currently not encrypted, however, we are in the progress of supporting this and the work is estimated to be completed by Q3 of 2021. This is referenced on our roadmap under the 'Security' section:

Bitbucket encryption at rest
Support for ensuring your repositories are encrypted when on disk

While this is not implemented yet, you can use the secured variables to store the sensitive data instead of directly writing it into the file. From the repository, you can manage repository variables in Repository settings > Pipelines > Repository variables

Secure variables are encrypted at rest using aes128 symmetric keys and stored in AWS DynamoDB tables in us-west-1. They're only ever sent over-the-wire via TLS (encrypted in transit). Bitbucket Pipelines is run in a SOC2 compliant environment, with the compliance report available via https://www.atlassian.com/trust/compliance

The variables are injected into the Docker containers environment variables list, making them available to all processes run from bitbucket pipelines.

Variables are masked in logs when uploaded, so log data never contains sensitive information; however anyone that can modify your build process could encode the value, for example using base64, and that base64 encoded value will not be detected and masked.

I hope this helps, but do let me know if you have any questions. 

Kind regards,
Caroline

Thank you for your answer. Unfortunately this is not a solution for my use case - working with Terraform -, but I am glad a solution is on the way, and apparently will soon be ready.

@Caroline RCan you provide any update on this issue? The roadmap you linked still says Q4 2021.

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events