Question about SSH Access Key scope

[Stacy O_Dell]

When adding an Access Key (SSH public key) at either the workspace, project, or repo level, is the scope of access truly limited to be read only?

The UI for adding keys seems to indicate that is the case for the project and repo level access keys, but the UI for adding workspace level access keys is not explicit about that.  I also couldn't find anything in the documentation per se.

My goal as we transition to BB Cloud from Data Center is to potentially eliminate the need for any service accounts that may have been previously used by automation simply for cloning and accessing repositories for read only purposes.

[Ben]

Hi @Stacy O_Dell 

You are correct that project/repo-level access keys are read-only.

Workspace-level SSH keys grant both read/write access to all repositories in the workspace, so I'd recommend using these with caution.

We have some documentation that explains this a little more in-depth:

• https://support.atlassian.com/bitbucket-cloud/kb/difference-between-repository-project-and-workspace-access-keys/

Hope this helps! :)

Cheers!

- Ben (Bitbucket Cloud Support)