Bitbucket OIDC AWS Authentication
You set up bitbucket oidc aws authentication by linking your build runner to an AWS identity provider. During a build, Bitbucket sends a short token to AWS and gets temporary keys back. Many teams start by storing static cloud keys inside their repo settings. Static keys never expire on their own and create high risk if someone leaks them. When teams switch to federated tokens, they often attach broad cloud roles to get builds working fast. A broad role lets any pipeline job change or delete liv
K8s OIDC Authentication + AWS IAM Policies: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up bitbucket oidc aws authentication by linking your build runner to an AWS identity provider. During a build, Bitbucket sends a short token to AWS and gets temporary keys back. Many teams start by storing static cloud keys inside their repo settings. Static keys never expire on their own and create high risk if someone leaks them. When teams switch to federated tokens, they often attach broad cloud roles to get builds working fast. A broad role lets any pipeline job change or delete live cloud resources without a second check.
How bitbucket oidc aws authentication works in pipelines
The workflow relies on OpenID Connect, which is an open standard for identity checks. Each Bitbucket workspace hosts a unique web address along with an audience value. You register both values inside your AWS account as a new identity provider. Next, you create an IAM role that trusts this specific identity provider. During a build run, Bitbucket creates a signed web token for that single step. The pipeline runner sends this signed token to the AWS token service. AWS checks the token signature against the public keys from your Bitbucket workspace. If the signature matches, AWS returns temporary access keys to the build runner. Those keys expire when the job ends, so you never store static secrets.
Scoping trust rules for repositories and branches
A basic trust rule lets any repo in your workspace assume the cloud role. That setup is too open for teams with many projects and shared accounts. Every token from Bitbucket carries claims that identify the exact repo and deployment step. You can add condition rules in AWS IAM to check these specific claims. This ensures only one repo can use the production deployment role during a build. You should create separate IAM roles for test builds and production deployments. If an engineer opens a pull request, that build only gets read permissions. Only merges to the main branch should get write permissions for live services. You also need to give each role the bare minimum cloud permissions it needs.
What federated tokens solve and what they leave open
Federated login removes the need to rotate static keys across dozens of repos. It proves which pipeline job asked for cloud permissions and stops secret sprawl. Still, identity checks only control how a build runner logs into the cloud account. Once the runner gets temporary keys, AWS allows any action within that role scope. IAM roles cannot inspect individual database queries or shell commands inside a deployment script. If a build script runs a bad database drop statement, the cloud role allows it. If a job reads a table with customer emails or card numbers, raw data flows back. Native cloud logs show that a role ran, but they miss the exact commands.
K8s OIDC Authentication + AWS IAM Policies: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why does my Bitbucket pipeline fail to assume the AWS role?
Most failures happen when the workspace address or audience value has a typo in AWS. Check that the repo claim in your IAM trust policy matches the repo identifier.
Do I still need to store AWS keys in Bitbucket repository variables?
No, you can delete static access keys once the federated token flow works. You only need to keep the IAM role identifier in your build script.
Can I limit which Bitbucket deployment stage uses a specific AWS role?
Yes, Bitbucket tokens include a claim for the specific deployment stage in the pipeline. You can match that stage value inside your AWS role trust policy conditions.