Vault and Password Manager for Jira — End User and Admin Guide
Overview
Vault and Password Manager for Jira enables teams to securely store, share, and audit sensitive credentials directly inside Jira issues and projects. This guide covers two perspectives: how end users work with vaults, entries, and sharing; and how administrators configure security, access, and compliance settings.
This guide is based on a short product walk-through and consolidates common usage patterns and best practices for both end users and administrators.
Key Concepts
Vault: A secure container for secrets (credentials, API keys, tokens) scoped to a project, team, or use case.
Entry: An individual secret record consisting of fields such as name, username, password/secret, URL, notes, and metadata.
Access Level: Determines who can view, edit, or administer a vault or entry (e.g., Owner, Editor, Viewer).
Sharing: Granting access to vaults or entries to users, groups, or project roles with least privilege.
Audit Log: A time-stamped record of who accessed or modified secrets to support accountability and compliance.
End User Guide
Getting Started
Open Jira and navigate to the project where the app is installed.
Access the app sidebar item labeled “Vault” or “Password Manager.”
Review existing vaults you have access to, or create a new vault if your permissions allow.
Creating a Vault
Select New Vault.
Enter a Vault Name and an optional Description that clarifies intended use (e.g., “Marketing Integrations,” “Prod SRE Credentials”).
Choose Default Access (e.g., private to owners; visible to a team or role).
Confirm to create. You will land on the empty vault screen ready to add entries.
Best practice:
Adding and Managing Entries
Inside the vault, click Add Entry.
Entry Name: Clear and descriptive, avoid including the actual secret in the title.
Username/ID and Password/Secret (or API Key).
URL or System to associate the secret with a target service.
Notes: Rotation policy, contact, or usage guidance.
Tags (optional): e.g., “production,” “billing,” “read-only.”
Click Save. The new entry appears in the vault list.
View/Reveal: Use the eye icon to reveal the secret briefly; copy using the copy icon to avoid exposing the value on screen.
Edit: Update fields; changes are versioned and logged.
Rotate: Replace credentials and add a note with rotation context and expiry policy.
Archive: Retire unused entries to reduce clutter while keeping history.
Linking Entries to Jira Issues
Open the relevant issue and locate the “Vault” panel or app section.
Click Link Entry and search or browse entries you can access.
Select the entry. A compact card appears showing name, tags, and quick actions (copy username/secret).
Do not paste secrets into issue descriptions or comments. Always use linked entries to preserve access controls and auditability.
Sharing and Permissions
Open the vault (or specific entry) and select Share/Manage Access.
Users
Groups
Project Roles
Owner: Full control (manage access, delete).
Editor: Create/edit entries, rotate secrets.
Viewer: Read-only access, can copy/reveal.
Save changes. Access updates take effect immediately and are tracked in the audit log.
Apply least privilege. Grant entry-level sharing for exceptions instead of broad vault-level permissions when possible.
Search and Filters
Use the search bar to find entries by name, tag, or target system.
Filter by environment, ownership, or last rotated to prioritize maintenance.
Activity and Audit
Open Activity/Audit in a vault to view access, edits, and permission changes.
Use time range and actor filters to investigate incidents or prepare reviews.
Keyboard and Productivity Tips
Copy buttons for username/secret reduce exposure and speed logins.
Favor notes and tags to encode rotation schedules and owners for quick triage.
Admin Guide
Installation and Provisioning
From Jira Settings → Apps → Find new apps, search for “Vault and Password Manager for Jira.”
Install the app and grant requested scopes. Confirm the app appears under Manage apps.
Assign initial App Admins and define which projects may use the app.
Global Configuration
Default Vault Visibility: Choose whether new vaults are private to creators or visible to project roles by default.
Role Mapping: Map app roles (Owner/Editor/Viewer) to Jira groups or project roles for consistent access control.
Naming and Tagging Conventions: Enforce patterns such as ENV-SYSTEM-TEAM (e.g., “PROD-Payments-SRE”).
Security Settings
Encryption: Confirm secrets are encrypted at rest and in transit; review KMS or key management options if provided by the app.
Reveals and Copy Controls: Configure screen masking and reveal timeouts to reduce shoulder-surfing risk.
Session Controls: Align secret access with Jira session and SSO policies; enable step-up verification for sensitive vaults if available.
IP Allowlists: Restrict secret access to corporate networks or approved ranges when supported.
Access Governance
Provisioning: Use groups and project roles to grant access at scale; avoid direct user grants where possible.
Offboarding: Integrate with your identity lifecycle. When a user leaves a group, their vault access should be removed automatically.
Break-glass: Define emergency access procedures with temporary, time-bound roles and mandatory post-incident review.
Audit, Monitoring, and Compliance
Audit Exports: Schedule exports of access and change logs to your SIEM for correlation and retention.
Rotation Policy: Establish minimum rotation intervals by tag (e.g., production every 90 days) and monitor exceptions.
Reviews: Quarterly vault reviews to prune stale entries, validate owners, and confirm least-privilege access.
Backups and Business Continuity
Backups: Verify the vendor’s backup frequency and retention. Document restore procedures and RPO/RTO expectations.
Vendor Status: Track app uptime SLAs and subscribe to status notifications.
Project-Level Controls
Restrict Vault Creation: Limit who can create new vaults to prevent sprawl; provide a request workflow for new vaults.
Templates: Offer pre-defined vault templates (fields, tags, default roles) for common systems like AWS, Databases, and SaaS apps.
Integrations
Directory: Sync groups from your IdP to keep role mappings current.
Automation: Use Jira automation or webhooks to notify owners on upcoming rotations or permission changes.
SIEM: Forward audit events for centralized monitoring.
Step-by-Step Scenarios
Create a Production Database Credential and Share with On-Call
Create or open the “PROD-DB-Platform” vault.
Add entry “Postgres Admin (prod-eu-west-1)” with username, secret, URL, and tag “production.”
Set vault-level View to “SRE group,” and entry-level Editor to “DBA group.”
Link the entry to the “Rotate prod DB password” Jira issue for visibility.
Document rotation policy in notes and schedule next rotation.
Investigate a Suspicious Reveal
Open the vault’s Audit view; filter by entry and time range.
Export the log and correlate with SIEM for IP and user session details.
Temporarily revoke access or downgrade to Viewer for the implicated role.
Rotate the secret and add an incident note referencing the Jira ticket.
Best Practices
Use separate vaults per environment and sensitivity.
Prefer group- and role-based access over direct user shares.
Never store secrets in issue text, attachments, or comments.
Rotate credentials on a fixed cadence and after personnel or scope changes.
Review audit logs regularly and export to centralized monitoring.
Document ownership and rotation policy in entry notes.