Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,298,515
Community Members
 
Community Events
165
Community Groups

Can you restrict who can send an email to update the status?

We're in the process if implementing this solution and when security reviewed the process their comment was that security through obscurity isn't appropriate.

The email address used to update the status is very long, random and unique enough not to be guessed. However, if this email address gets compromised then anyone from any random source address can update the status.

Is there a way to restrict the update to a predefined list of source domains and/or email addresses?

1 answer

1 accepted

0 votes
Answer accepted
Darryl Lee Atlassian Team May 05, 2022

Hi @First Title

This is Darryl. I am here to help. 

Thanks for the feedback on the security concerns about the Email automation for Statuspage components.

Unfortunately, there is no way to restrict the "from" sources for the Emil automation and we do have an existing feature request to "Create Allowlist for Email Addresses used in Component Automation".

The ticket ID is, STATUS-348, and we will keep you posted because the ticket doesn't provide any public access to our customers.

Thank you very much again for your feedback in helping us improve Statuspage.

Have a great day and stay safe.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

Darryl Lee Atlassian Team May 05, 2022

@First Title, On the other hand, we also recommend switching to using the third-party services (Pingdom/New Relic) or the "unsupported" third-party services as alternatives for Statuspage component status automation. -> https://support.atlassian.com/statuspage/docs/get-started-with-email-automation/#Using-third-party-services

Or, if you also have an Opsgenie subscription, it would be awesome to incorporate the Statuspage integration for accomplishing this objective.

Hope this helps.

Kind regards,
Darryl Lee
Support Engineer, Atlassian

Thanks for your reply, happy to be on your distribution list to be notified when STATUS-348 get released into production. 

The third-party & alternate services to update the component still rely on an obscure email address which doesn't mitigate the security concern raised initially.

I note there is no option to turn off the email address or this automation service. Even if we chose to only update the components manually, the risk remains the same.

Like Darryl Lee likes this
Darryl Lee Atlassian Team May 06, 2022

Thanks for the extra feedback and I have added them to the feature request ticket for our development team as a reference.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Statuspage

New feature: Slack notifications for Statuspage

We're excited to announce the release of a long-requested feature on Statuspage. Now visitors to your status page can subscribe to get notified in Slack when you report an incident or maintenance. Th...

3,063 views 8 20
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you