Default security settings in Bamboo

We provide pre-configured solutions with the most secure settings as default. Our mission is to unleash the potential of every team, prioritizing security every step of the way. Bamboo comes with a set of default settings that provide administrators with the assurance that the product is secured immediately after installation, without requiring any additional steps.

All our Data Center products offer exceptional flexibility in terms of configuration. Many settings can be adjusted during the installation or pre-configuration process. In our commitment to strengthen security measures, we've implemented a range of default settings to mitigate the most common threats and vulnerabilities, thus reducing the risk of unintentionally exposing critical systems due to misconfiguration.

The following settings list with corresponding documentation will assist you in elevating the security level of your Bamboo instances. Some of the documents below contain child pages. Refer to them as well to enhance the security of your instance.

1. Deployment

This documentation covers the process of deployment and includes: supported platforms, requirements, end-of-life policies, network setup, security protocols, infrastructure configurations, and the installation and configuration of software components such as Java, Tomcat, and databases.

• End of support announcements

• Supported platforms. For application servers, Bamboo runs on a bundled Apache Tomcat and it's the only supported configuration.

• Deployment permissions

2. Setup

This documentation focuses on configuring Bamboo after deployment. It includes guides on setting up environments, configuring connection settings, managing data storage, and ensuring that all components support the instance.

• Securing Bamboo with Tomcat using SSL

• System settings

• Logging in Bamboo

• Connect Bamboo to an external database

• Securing a database password

• Changing Bamboo database settings

• Clustering with Bamboo Data Center

• Repository-stored Bamboo Specs security

• Bamboo Specs encryption

3. Authentication, authorization, user management, and security

This documentation relates to securing applications and managing user access. It covers authentication and authorization mechanisms, user management, permissions, and security best practices.

• Single Sign-On overview of Data Center products

• Encrypting passwords in server.xml

• Administering users and permissions

• Bamboo permissions overview

• Configuring project permissions

• Configuring a plan's permissions

• Creating and configuring a deployment project

• Permissions for deployment environments

• Linked Repository permissions

• Restoring passwords to recover admin users
• Personal access token
• Repository-stored Specs thread permissio

4. Runtime, performance monitoring, and troubleshooting

This documentation focuses on monitoring and maintaining instances after setup. It includes guides on performance monitoring, handling runtime issues, and troubleshooting common problems.

• Managing data and backups

• Recommended settings for monitoring memory usage and garbage collection

5. Integrations and third-party apps

This documentation covers integrating Bamboo with other Atlassian products and creating and integrating third-party apps with Bamboo.

• Integrating with other Data Center products and incoming or upcoming links

• Linking to source code repositories

• Configuring Elastic Bamboo