Project: Checkov (Provisioning / Security & Compliance)
File: Bitbucket.md

layout: default published: true title: Bitbucket configuration scanning nav_order: 20 Checkov supports the evaluation of policies on your Bitbucket organization and repositories settings. When using checkov with Bitbucket token it can collect your current org settings and validate it complies with Bitbucket security best practices such as having branch protection rules having 2 approvals. Full list of bitbucket organization and repository settings related checks can be found . | Environment Variable | Default value | Description | |-|-|-| | CKVBITBUCKETCONFIGFETCHDATA| "True" | checkov will try to fetch Bitbucket configuration from API by default (unless no access token provided) | | CKVBITBUCKETCONFDIRNAME | "bitbucketconf" | checkov will create a new directory named "bitbucketconf" under current working directory | | CISERVERURL | "https://api.bitbucket.com/" | | | APP_PASSWORD | | Bitbucket personal access token to be used to fetch Bitbucket configuration | | BITBUCKET_USERNAME | | Bitbucket username (not email) | | BITBUCKETREPOFULL_NAME | | workspace/repository, for example prisma/terragoat | ```json { "pagelen": 10, "values": [ { "kind": "requiredefaultreviewerapprovalsto_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" } }, "pattern": "master", "value": 1, "branchmatchkind": "glob", "groups": [], "type": "branchrestriction", "id": 26522110 }, { "kind": "requireapprovalsto_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" } }, "pattern": "master", "value": 3, "branchmatchkind": "glob", "groups": [], "type": "branchrestriction", "id": 26520791 }, { "kind": "force", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" } }, "pattern": "master", "value": null, "branchmatchkind": "glob", "groups": [], "type": "branchrestriction", "id": 26520790 }, { "kind": "delete", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" } }, "pattern": "master", "value": null, "branchmatchkind": "glob", "groups": [], "type": "branchrestriction", "id": 26520789 } ], "page": 1, "size": 4 } ``` ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.bitbucket.basebitbucketconfiguration_check import BaseBitbucketCheck from checkov.bitbucket.schemas.branchrestrictions import schema as branchrestrictions_schema from checkov.json_doc.enums import BlockType class MergeRequestRequiresApproval(BaseBitbucketCheck): def init(self): name = "Merge requests should require at least 2 approvals" id = "CKVBITBUCKET1" categories = [CheckCategories.SUPPLY_CHAIN] super().init( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scanentityconf(self, conf): if branchrestrictionsschema.validate(conf): for value in conf.get("values", []): if value.get('kind','') == 'requireapprovalsto_merge': if value.get('value',0)>=2: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = MergeRequestRequiresApproval() ``` ```bash export APPPASSWORD="ghpabc" export BITBUCKET_USERNAME="username" export BITBUCKETREPOFULL_NAME="prisma/terragoat" checkov -d . --framework bitbucket_configuration ``` ```bash _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ bitbucket_configuration scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKVBITBUCKET1: "Merge requests should require at least 2 approvals" FAILED for resource: /bitbucketconf/branchrestrictions.json File: /bitbucketconf/branchrestrictions.json:2-66 2 | "pagelen": 10, 3 | "values": [ 4 | { 5 | "kind": "requiredefaultreviewerapprovalsto_merge", 6 | "users": [], 7 | "links": { 8 | "self": { 9 | "href":

10 | } 11 | }, 12 | "pattern": "master", 13 | "value": 1, 14 | "branchmatchkind": "glob", 15 | "groups": [], 16 | "type": "branchrestriction", 17 | "id": 26522110 18 | }, 19 | { 20 | "kind": "requireapprovalsto_merge", 21 | "users": [], 22 | "links": { 23 | "self": { 24 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" 25 | } 26 | }, 27 | "pattern": "master", 28 | "value": 1, 29 | "branchmatchkind": "glob", 30 | "groups": [], 31 | "type": "branchrestriction", 32 | "id": 26520791 33 | }, 34 | { 35 | "kind": "force", 36 | "users": [], 37 | "links": { 38 | "self": { 39 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" 40 | } 41 | }, 42 | "pattern": "master", 43 | "value": null, 44 | "branchmatchkind": "glob", 45 | "groups": [], 46 | "type": "branchrestriction", 47 | "id": 26520790 48 | }, 49 | { 50 | "kind": "delete", 51 | "users": [], 52 | "links": { 53 | "self": { 54 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" 55 | } 56 | }, 57 | "pattern": "master", 58 | "value": null, 59 | "branchmatchkind": "glob", 60 | "groups": [], 61 | "type": "branchrestriction", 62 | "id": 26520789 63 | } 64 | ], 65 | "page": 1, 66 | "size": 4 Check: CKVBITBUCKET1: "Merge requests should require at least 2 approvals" FAILED for resource: /bitbucketconf/projectapprovals.json File: /bitbucketconf/projectapprovals.json:2-66 2 | "pagelen": 10, 3 | "values": [ 4 | { 5 | "kind": "requiredefaultreviewerapprovalsto_merge", 6 | "users": [], 7 | "links": { 8 | "self": { 9 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" 10 | } 11 | }, 12 | "pattern": "master", 13 | "value": 1, 14 | "branchmatchkind": "glob", 15 | "groups": [], 16 | "type": "branchrestriction", 17 | "id": 26522110 18 | }, 19 | { 20 | "kind": "requireapprovalsto_merge", 21 | "users": [], 22 | "links": { 23 | "self": { 24 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" 25 | } 26 | }, 27 | "pattern": "master", 28 | "value": 1, 29 | "branchmatchkind": "glob", 30 | "groups": [], 31 | "type": "branchrestriction", 32 | "id": 26520791 33 | }, 34 | { 35 | "kind": "force", 36 | "users": [], 37 | "links": { 38 | "self": { 39 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" 40 | } 41 | }, 42 | "pattern": "master", 43 | "value": null, 44 | "branchmatchkind": "glob", 45 | "groups": [], 46 | "type": "branchrestriction", 47 | "id": 26520790 48 | }, 49 | { 50 | "kind": "delete", 51 | "users": [], 52 | "links": { 53 | "self": { 54 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" 55 | } 56 | }, 57 | "pattern": "master", 58 | "value": null, 59 | "branchmatchkind": "glob", 60 | "groups": [], 61 | "type": "branchrestriction", 62 | "id": 26520789 63 | } 64 | ], 65 | "page": 1, 66 | "size": 4 ``` To add more Bitbucket policies and configuration to be inspected take a look at the