What is the best way to secure/limit access of the account used by Jira Mobile Connect?

[Systems Engineering]

What is the best way to limit the account used by Jira Mobile Connect (API) so that it can submit issues but otherwise does not really have access to any other projects or even other issues in the same project that it is submitting against? We don't want to expose ourselves unnecessarily.

Thanks in advance for the guidance.

[Systems Engineering]

This may not be the best or most elegant way to handle this, but here's what I did:

• created a role account - we'll call it "submit issues only"
• added the user used by the api key to the role in the given project
• created a new permission scheme - we'll call it "basically no perms"
  • In that scheme added "submit issues only" role to "create issues" and "create attachments"

We added additional security that limited the scope of jira access from "outside" and this is where we have landed. If only Atlassian cared to document some best practices (and/or care about security) we would _know_ if this was the best way to handle this within the contraints of their software.

[Gregory Sudderth]

I would like to see an authoratative answer on this from Atlassian--its vital to the successful deployment of the product!