Bitbucket How to: Monitoring Configuration Changes & Integrity verification Tools

[Hector Concepcion]

Hi All,

Currently one of our business partners is requiring that we have in place a Monitoring Configuration Changes and Integrity Verification Tool for a couple of repositories we have hosted on bitbucket cloud.

Does Bitbucket cloud  has these type of tool integrated that can be configured? If so were can it be found?

Or any external tool that can integrate to the repositories to be able accomplish these task?

I am fairly new to Bitbucket tools, any information would be helpful.

Thanks in advance.

[Boris Alyurov]

Hi,

Can a GIT pre-commit hook be used for that? If so, how can that be enabled for Bitbucket cloud? 

Thanks 

[Theodora Boudale]

Hi Boris,

A pre-commit hook is a client-side hook, so it can be configured locally on users' computers. Server-side hooks are not supported in Bitbucket Cloud. We have a feature request for a server-side pre-receive hook:

• https://jira.atlassian.com/browse/BCLOUD-10471

You can read the pinned comment from one of our product managers in this feature request.

Could you please share, what exactly are you looking to monitor with a hook?

Kind regards,
Theodora

[Mehmet]

Hi @Theodora Boudale ,

As part of a security audit, we have been asked about the measures in place to ensure the integrity of our code in Bitbucket Cloud. While there is documentation available for Bitbucket Jira Data Center, I couldn't find documentation outlining the integrity precautions taken for the Cloud version. Below Cloud link mentions about encryption at rest/transit, uptime and access. These are Confidentiality and Availability but not about Integrity.

Can Atlassian update the doc to include integrity related precautions taken for Bitbucket Cloud?

https://confluence.atlassian.com/bbkb/how-secure-is-my-code-is-the-service-reliable-1168845123.html

[Theodora Boudale]

Hi Mehmet,

Thank you for reaching out.

You can find measures taken for system and information integrity here:

• https://www.atlassian.com/legal/security-measures#system-information-integrity

I will ask my team to update the knowledge base article you shared and include this link.

In addition to that, Bitbucket Cloud offers the options to:

• disable history rewriting in branches via branch restrictions, to ensure that your code isn't accidentally or maliciously erased by an authorized user with Git force pushing
• set up default and custom merge checks that can be enforced with the Premium plan, so that code changes can be reviewed before they are merged

With regards to the document you shared for Bitbucket Data Center, the integrity checks mentioned on this page scan a Bitbucket Data Center instance only for inconsistencies between the database and home directory. Bitbucket Cloud is not the Bitbucket Data Center version on Cloud. It is a different product with different architecture, so these scans are not applicable to Bitbucket Cloud.

Kind regards,
Theodora

[Theodora Boudale]

Hi Hector and welcome to the community!

The tools you mentioned are server tools for monitoring changes in critical system files, directories, registry settings, etc in one's server. Bitbucket Cloud does not provide physical or virtual servers, it hosts Git repositories.

If you are not familiar with version control, Git, and Bitbucket, you can check the tutorials here for an introduction and some more advanced topics:

• https://www.atlassian.com/git/tutorials

For a more in-depth understanding of Git, you can also refer to the Git book here:

• https://git-scm.com/book/en/v2

What kind of configuration changes are you looking to monitor and what do you want to verify the integrity of?

Kind regards,
Theodora