Do repo pipeline SSH public keys need to be added explicitly to a remote repo for access?
Asked by Tim Apps:

Hi team,

Within our Bitbucket Cloud workspace I have several repos which use pipelines to access another repo in the same workspace, for example...

```
definitions:
  steps:
    - step: &clean_build_branch
        name: Clean build branch
        script:
          - git archive -o a_file.tar --remote=git@bitbucket.org:xxxx/yyyy.git HEAD bin/a_file.txt
```

Until now no explicit SSH keys have been defined in the remote repo:  

![Screenshot 2023-10-31 122440.png](https://community.atlassian.com/t5/image/serverpage/image-id/289353iD2EC94D4B908FE3D/image-dimensions/401x258?v=v2 "Screenshot 2023-10-31 122440.png")

For existing repos trying to access this remote repo I am able to execute pipeline commands such as a remote git archive function mentioned above.

Furthermore, if I try to add the public SSH key of the repo to the Security-\>Access keys of the remote repo I see an error message implying that the key exists already (in \~/.ssh/authorized_keys I assume) - '..... Please use a unique SSH key':

![Screenshot 2023-10-31 122322.png](https://community.atlassian.com/t5/image/serverpage/image-id/289354i7829987C9AC5324C/image-size/large?v=v2&px=999 "Screenshot 2023-10-31 122322.png")

... this explains why the git archive remote command works (as the public SSH key is present on the remote repo). All good.

However, I have found that when creating new repos that I need to explicitly add the public SSH keys to the remote repo using Security-\>Access keys to allow remote git functions to work.

Within the same Bitbucket Cloud environment I wondered if I am missing some configuration that allows a repo public SSH key to be automatically availalble to all other repos in the same Workspace, or whether this behaviour, whereby a key must be copied into the remote repo Access keys, is expected due to a recent change in how public SSH keys within the same Workspace are shared - perhaps this is a feature that has been deprecated in favour of explicit public SSH key definition?

Sincerely, Tim


Answers:
author: Theodora Boudale
body: Hi Tim!

If you want to perform an operation via SSH in repo B during a pipeline that runs in repo A, then you need to set up SSH access, this is expected behavior. Adding the SSH key to the Access keys of repo B is one option. There are other options:

**1.** Instead of adding the public SSH key to the repo's Access keys, you could add it to a project's Access keys (if you are a project or workspace admin). On Bitbucket website select **Projects** from the menu at the top (while viewing your workspace) \> select a project \> select **Project settings** \> select **Access keys**.

Adding the key there will grant **read-only access** via SSH to all repos of that specific project during a build in repo A, without the need to add the key to every single repo of the project.

**2.** You could also add the public SSH key to the workspace's SSH keys (if you are a workspace admin) from **Workspace settings** \> **SSH keys** . Please be mindful though that workspace SSH keys provide **read-write access to all of the workspace's repos**, which means that any developer with write access to repo A could edit its pipeline and push to any repo of the workspace.

These other two options may provide access to more repos that you actually need.

Please feel free to let me know if you have any questions!

Kind regards,  
Theodora

comments: author: Tim Apps
body: Hi [@Theodora Boudale](/t5/user/viewprofilepage/user-id/818086) , thank-you very much for the clear answer - that's great!

Many thanks, Tim


Tags: bitbucket-cloud

cloud