Publish an official HashiCorp Vault secrets engine plugin for Bitbucket Cloud Access Token lifecycle management

XMLWordPrintable

    • 1

      Problem

      Bitbucket Cloud access tokens (Workspace, Project, and Repository) cannot be viewed again after creation in the UI and have no programmatic API for creation, rotation, or revocation (https://jira.atlassian.com/browse/BCLOUD-22302). Organizations that use HashiCorp Vault as their secrets management platform have no way to automate the full token lifecycle, tokens must be manually created in the Bitbucket UI, copied into Vault, and manually rotated when they expire.

      Requested solution

      Publish an official HashiCorp Vault secrets engine plugin for Bitbucket Cloud that can manage access token lifecycle (creation, rotation, and revocation) directly from Vault. This would follow the same pattern as existing Vault integrations published at https://developer.hashicorp.com/vault/integrations, using Vault's custom secrets engine framework ([Custom secrets engine | Vault | HashiCorp Developer|https://developer.hashicorp.com/vault/tutorials/custom-secrets-engine]).

      This plugin would:

      • Use the Bitbucket Cloud Access Token API (once available per https://jira.atlassian.com/browse/BCLOUD-22302) as the underlying mechanism
      • Allow Vault to create, store, rotate, and revoke access tokens programmatically
      • Enable organizations to manage Bitbucket credentials alongside their other secrets using their existing Vault infrastructure

      Why Atlassian should build this

      While organizations could build their own custom secrets engine once the API from BCLOUD-22302 is available, an officially supported Vault plugin would:

      • Reduce duplicated effort across the customer base
      • Ensure the plugin stays current with API changes
      • Provide a trusted, maintained integration path for enterprise customers
      • Align with how other platforms (AWS, GCP, Azure, GitHub) already integrate with Vault

      Impact

      Enterprise CI/CD environments managing hundreds of repositories and multiple workspaces currently face:

      • Manual token creation and rotation via UI only
      • Tokens that cannot be retrieved after initial creation, requiring immediate secure storage
      • No automation path for credential lifecycle, increasing operational risk and toil
      • Inability to leverage existing Vault policies, audit trails, and TTL management for Bitbucket credentials

      Dependencies

      This feature depends on https://jira.atlassian.com/browse/BCLOUD-22302 — an API for access token management must exist before a Vault plugin can be built on top of it.

      Related requests

              Assignee:
              Unassigned
              Reporter:
              Jairo O
              Votes:
              2 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: