Answers: <p>In an enterprise environment (but even in a personal one, I assume tech savvy enough users to do that) it's generally a good idea to have dedicated accounts created specifically for automated tools execution.</p>
  
  <p>I'd even recommend one account per tool because different tools may have different permission requirements and it's generally a good idea to limit the permission scope to the minimum required, for security reasons. In large enterprises this is often mandatory, prescribed by policies.</p>
  
  <p>In some cases it might be necessary to have different tools executed under the same account, in which case such combo accounts would be required. Again, one per specific use case.</p>
  
  <p>If you want a parallel - take a look at a Linux system, for example - different system accounts used for different purposes. Or service accounts, <a href="https://cloud.google.com/iam/docs/understanding-service-accounts" rel="nofollow noreferrer">at Google</a> for example.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-13T15:52:24.757Z
Answers: Dan, thanks for the help! You're feedback makes a lot of sense. I only add that I'm a little more interested in which Bitbucket specific authentication mechanism folks recommend vs. shared or dedicated account paradigm. That said, dedicated accounts make a lot of sense for the reasons you mentioned.
Answers: Adam
Answers: CC BY-SA 4.0
Answers: 2019-04-13T14:40:22.147Z
Answers: 2019-04-13T14:40:22.147Z
Answers: Dan Cornilescu
Body: <p>What's the "best-practice" approach to authenticate a CI tool like Jenkins or Bamboo to BitBucket? I started with App Passwords because it's cheap and easy, but I hate that it's tied to my account because if I leave the company, the CI/CD integration with Bitbucket gets killed.</p>
  
  <p>Is there anything that isn't scoped to a specific user?</p>
  
Tags: <jenkins><bitbucket>
Title: Best Practice Authenticating Jenkins to Bitbucket to Access Team Repository
UserDisplayName: Adam
ThreadText: # Best Practice Authenticating Jenkins to Bitbucket to Access Team Repository
  
  (Asked by: username_0 on 2019-04-12)
  
  What's the "best-practice" approach to authenticate a CI tool like Jenkins or Bamboo to BitBucket? I started with App Passwords because it's cheap and easy, but I hate that it's tied to my account because if I leave the company, the CI/CD integration with Bitbucket gets killed.
  
  Is there anything that isn't scoped to a specific user?
  
  **Tags:** jenkins, bitbucket
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-04-13. Score: 1 | Accepted answer
  
  In an enterprise environment (but even in a personal one, I assume tech savvy enough users to do that) it's generally a good idea to have dedicated accounts created specifically for automated tools execution.
  
  I'd even recommend one account per tool because different tools may have different permission requirements and it's generally a good idea to limit the permission scope to the minimum required, for security reasons. In large enterprises this is often mandatory, prescribed by policies.
  
  In some cases it might be necessary to have different tools executed under the same account, in which case such combo accounts would be required. Again, one per specific use case.
  
  If you want a parallel - take a look at a Linux system, for example - different system accounts used for different purposes. Or service accounts, [at Google](https://cloud.google.com/iam/docs/understanding-service-accounts) for example.
  
  > **Comments:**
  > **username_0**: Dan, thanks for the help! You're feedback makes a lot of sense. I only add that I'm a little more interested in which Bitbucket specific authentication mechanism folks recommend vs. shared or dedicated account paradigm. That said, dedicated accounts make a lot of sense for the reasons you mentioned.  
  
  ---
  
  