Find user-specific information on projects/repositories access in Bitbucket DC

Summary

This article shares options to extract user-specific information on access to projects/repositories.

Context:

This information might be helpful in the following scenarios:

Security Audits: To ensure users have appropriate access levels and identify unauthorised access.

1. User Activity Monitoring: To track usage patterns or investigate specific user actions.

2. Access Management: To review or adjust user permissions based on activity.

3. Troubleshooting Access Issues: To verify access history when users report issues.

4. Compliance and Reporting: To generate reports for regulatory requirements. A use case would be to verify the actions of a suspicious user or to validate a user's project/repo permissions.

Environment

All Bitbucket-supported versions

Solution

There are two ways to get project/repository access information from Bitbucket.

• Extracting information from access logs: Bitbucket_Home/log/atlassian-bitbucket-access.log/atlassian-bitbucket-access*.log holds details for requests coming from all users towards Bitbucket and file gets. To get the details of a specific user operation, you can follow the steps below and confirm if you are getting the result:

  • Log in to the Bitbucket Data Center and go to <Bitbucket_Home>/log directory.

  • Check for the access logs via the command line:

    ls -lrt atlassian-bitbucket-access*

    You may get more files where you can check if you need a specific date file or the latest access log file.

  • Use grep for the username on the found results to check for any entries:

    grep -i "username" <file_name>

    In case you want to check all access logs, use atlassian-bitbucket-access*.log for the filename.

• Querying the Audit log table: By default, the Coverage level for Repository accessed by user (RepositoryAccessedEvent) is Base; hence, without any need for updating configurations, you can easily access information related to repositories accessed by a user by using the below database query:

  select * from "AO_C77861_AUDIT_ENTITY" acae where "ACTION" ='Repository accessed by user' and "USER_NAME" ='admin';

Please note that there are many events in the audit log that you can enable based on the different coverage level details present in this documentation: Audit log events.