Bitbucket Access Key Rotation

[Jin Yu Tung]

Given the limitation of the access key that it doesn't require a passphrase and cannot be associated with an account. It can be the case that one still have the read access of the private repository after his/her account revoked. Or worse, the leaked private key can causes an unauthorised third party gains access to the private repository. 

Is there a way to

• rotate the access key
• remind the admin/ creator of the key regarding the expiration of the key
• control the creation of the key on an approval basis

? 

[Mark C]

Hi @Jin Yu Tung,

Thank you for reaching out to the community.

Right now, there's no feature to manage repository Access keys' by setting policies such as rotating it periodically, or set an expiration, or controlling the creation.
We do have an existing feature request similar to it that can be located through this link. - https://jira.atlassian.com/browse/BCLOUD-21080
You can upvote and watch it for now so that you'll be notified of any updates from our team when the feature becomes available on Bitbucket Cloud.

For now, you'll have to manually rotate repository Access keys periodically by removing and generating new SSH keys.

For the workflow recommendation, I would recommend using the user's personal SSH keys instead and then managing their read access to the specific repository or workspace user groups.
This way, whenever a user is revoked, the SSH key will also be revoked.

Hope it helps and do let me know if you have further questions.

Regards,
Mark C

[Jin Yu Tung]

Hi Mark C, 
Is there a way to restrict a user from creating an access key currently? 

[Mark C]

Hi @Jin Yu Tung

Right now, only admins can create repository Access keys and there's no feature to restrict admins from creating an access key.
However, as long a user only has Read or Write access to the repository, they won't be able to create Access keys.

Let me know if you have further questions.

Regards,
Mark C