Cloud App Permissions
Jenkins for Jira, Jenkins for Compass and Jenkins for Confluence are Atlassian Forge apps. Every app declares the permissions (scopes) it needs in its manifest and Atlassian asks for your consent to these when the app is installed or when a newer version of the app requires additional permissions. The apps only request the permissions listed below.
All Apps
| Permission | Reason |
|---|---|
storage:app |
Required to store the app data, such as the Jenkins sites, jobs and builds, in the data residency realm of your site. The apps store their data in their own backend, and not in Forge storage, but Forge requires this permission to do so. |
read:app-system-token |
Required to let the app backend act on behalf of the app when there is no user involved, such as when synchronizing Jenkins builds, checking the app installation and migrating the app data to another data residency realm. |
read:app-user-token |
Required to let the app backend act on behalf of the user viewing or using the app, such as when checking the permissions of the user, getting the time zone of the user or executing an Automation Rule action as the rule actor. |
Jenkins for Jira
| Permission | Reason |
|---|---|
read:jira-user |
Required to get user specific details like the time zone of the user, to check the permissions of the user, and to record who triggered a build. |
read:jira-work |
Required to check the existence of issue keys identified during the synchronization of jobs and builds, to look up issues and projects, and to read the app configuration and issue properties written by the app. |
write:jira-work |
Required to store a summary of the linked builds on every issue as an issue property, which powers Search by Build, and to store the app configuration as app properties. The app does not create, update or transition issues. |
read:email-address:jira |
Required to collect the email addresses of users that administer the app, needed to have a point of contact for important updates and notifications to be shared with. Contact information from the app license is not covering this. |
read:build-info:jira |
Required to declare the app as a build data provider for the Development Panel Integration. |
write:build-info:jira |
Required to write build data for the Development Panel Integration. |
delete:build-info:jira |
Required to delete build data from the Development Panel Integration when a build, job or Jenkins site is deleted or unlinked. |
read:deployment-info:jira |
Required to declare the app as a deployment data provider for the Development Panel Integration. |
write:deployment-info:jira |
Required to write deployment data for the Development Panel Integration and the Deployment Build Marker. |
delete:deployment-info:jira |
Required to delete deployment data from the Development Panel Integration when a deployment, job or Jenkins site is deleted or unlinked. |
Jenkins for Compass
| Permission | Reason |
|---|---|
read:component:compass |
Required to look up and search the components of your Compass site, and to find the components linked to Jenkins jobs. |
write:component:compass |
Required to create and delete the links between Compass components and Jenkins jobs. |
read:event:compass |
Required to declare the app as a build and deployment event data provider for the linked components. |
write:event:compass |
Required to send build and deployment events of the linked Jenkins jobs to the components. |
read:metric:compass |
Required to declare the built-in metrics the app provides, such as the deployment frequency, build time and build success rate, which Compass derives from the build and deployment events sent by the app. |
write:metric:compass |
Required to let Compass store the values of the built-in metrics derived from the build and deployment events sent by the app. |
Jenkins for Confluence
Jenkins for Confluence requires no permissions besides the ones all apps require. Its macros show Jenkins job and build data from the app backend, no Confluence content is read or written by the app.
Cloud App IP Addresses
The apps are served from a data residency realm, and use a small set of IP addresses per realm to reach your Jenkins instance(s). You should allow-list the IP addresses of the realm your Jira site is served from to maintain the integration with your on-premise Jenkins instance(s). If you are unsure which realm that is, allow-list the IP addresses of all realms:
| Realm | IP Addresses | Machine consumable |
|---|---|---|
| EU Europe (default) |
34.255.62.2734.246.239.18034.242.243.113 |
https://jjc.marvelution.com/status/ip-addresses |
| US United States |
107.20.192.169 |
https://us.jjc.marvelution.com/status/ip-addresses |
Jenkins to Jira Path Access Permissions
Jenkins notifies Jira when a build in completed. It does this be accessing https://(eu.|us.)jjc.marvelution.com/rest/[tenant.id]/*
Data send to Jira depends on how the Jenkins site is registered in Jira.
- In case the site is registered as an accessible site, then it’s an empty trigger for Jira app to synchronize a newly completed build.
- In case the site is registered as an inaccessible site, then the trigger contains the data the Jira app needs to synchronize and index the build.
Jira to Jenkins Path Access Permissions
Below lists the paths that the Jira app will access in a configured Jenkins site.
[GET] plugin/jira-integration/ping.html is used to check if the Jira Integration plug-in is installed on the Jenkins site.
[POST] jji/register/ is used to register the Jira site with the Jenkins site.
[POST] jji/unregister/ is used to unregister the Jira site with the Jenkins site, done when a site is deleted in Jira.
[GET] **/api/json/ is used to collect job and build data from Jenkins.
[POST] **/jji/build/ is used to trigger a new build of a job on Jenkins.
Previous: Use case: Publish version on release
Next: Releases
