OpenID Connect at workspace level

[Neil Hunt]

We have many apps that we deploy to AWS, each in their own repository. From the documentation for using OpenID for AWS, it states that we use our Provider URL and Audience. It doesn't say exactly where to get them, but I found them inside of the repository settings. This would be arduous to need to create a new IAM role and OpenID provider connection on every single repository. Is there a way to do this at the Bitbucket Workspace level, such that I can create a role and have it be available to all repositories and pipelines within a Workspace or Project?

[Theodora Boudale]

Hi Neil,

The Identity provider URL and the Audience you see in the Repository settings > OpenID connect are the same for all repositories belonging to the workspace.

You don't need a new Identity Provider for each repository. The page you linked also states this:

The above steps allow any repository under the workspace to assume the created role, and also allows anyone with the token to assume the role.

Please feel free to reach out if you have any questions.

Kind regards,
Theodora