DevOps Stack Exchange is a question and answer site for software engineers working on automated testing, continuous delivery, service integration and monitoring, and building SDLC infrastructure. It only takes a minute to sign up.
Sign up to join this community
What's the "best-practice" approach to authenticate a CI tool like Jenkins or Bamboo to BitBucket? I started with App Passwords because it's cheap and easy, but I hate that it's tied to my account because if I leave the company, the CI/CD integration with Bitbucket gets killed.
Is there anything that isn't scoped to a specific user?
In an enterprise environment (but even in a personal one, I assume tech savvy enough users to do that) it's generally a good idea to have dedicated accounts created specifically for automated tools execution.
I'd even recommend one account per tool because different tools may have different permission requirements and it's generally a good idea to limit the permission scope to the minimum required, for security reasons. In large enterprises this is often mandatory, prescribed by policies.
In some cases it might be necessary to have different tools executed under the same account, in which case such combo accounts would be required. Again, one per specific use case.
If you want a parallel - take a look at a Linux system, for example - different system accounts used for different purposes. Or service accounts, at Google for example.
