Jira

This plugin for the compliance-framework evaluates Jira and Jira Service Management (JSM) data to ensure Change Request processes are properly followed prior to new deployments.

This page is for operators who run the plugin-jira plugin with the CCF Agent, and for developers who write policies for it. It documents v0.2.3 and is generated from the plugin's README at v0.2.3.

How it works

Usage

The plugin implements the Runner interface and is executed by the compliance agent.

# Example execution (internal to framework)
./plugin-jira --config config.json

Requirements

Setup Instructions

1. Authentication Setup

The plugin supports two authentication methods:

Option A: Service Account + OAuth2 (Recommended for Cloud)

This method uses Jira's OAuth 2.0 (3LO) for apps or more specifically, for service-to-service integrations, you typically use API Tokens with a Service Account or OAuth 2.0 Client Credentials (if available for your organization).

How to set up a Service Account:

1. Create a dedicated Atlassian account (e.g., compliance-bot@yourcompany.com).
2. Invite this account to your Jira instance.
3. Follow Atlassian's guide on Service Accounts.

Option B: API Token (Fallback)

1. Log in to Jira as the Service Account.
2. Go to Account Settings > Security > API Tokens.
3. Create a new API token and save it securely.

2. Minimal Permissions (Scopes)

The Service Account needs the following minimal permissions to collect compliance data:

• Global Permissions:
  • Browse Users (to see approvers and authors)
• Project Permissions (for all target projects):
  • Browse Projects
  • View Development Tools (for Software API dev links)
  • Administer Projects (optional, for detailed workflow/scheme inspection)
• OAuth Scopes (Cloud):
  • read:jira-work
  • read:jira-user
  • read:servicedesk-request
  • manage:jira-configuration (for workflows and schemes)

Configuration

The plugin is configured via the PluginConfig structure:

Parameter	Description
base_url	The URL of your Jira instance (e.g., https://your-domain.atlassian.net)
auth_type	oauth2 or token
client_id	OAuth2 Client ID (for oauth2 auth)
client_secret	OAuth2 Client Secret (for oauth2 auth)
api_token	API Token (for token auth)
user_email	Service Account email (for token auth)
project_keys	Comma-separated list of Project Keys to monitor
policy_labels	JSON map of labels to attach to generated evidence

Policy data

Any policy_data set on this plugin's block in the agent configuration is passed to every policy evaluation and is available to Rego as data.<key>. Which keys are read depends on the policy bundle; for example:

plugins:
  jira:
    # ...source, policies and config as usual...
    policy_data:
      approver_groups:
        - change-advisory-board

Evidence collected

Features

• Authentication: Supports OAuth2 (2-Legged OAuth / Client Credentials) and API Tokens.
• Data Collection:
  • Jira Platform: Projects, Workflows, Schemes, Issue Types, Custom Fields, Audit Records, and Permissions.
  • Jira Service Management: Native Approvals and SLAs.
  • Jira Software: Development Information (GitHub PRs/commits) and Deployment events.
• Policy Evaluation: Integration with OPA policies to calculate compliance evidence based on collected Jira metadata.

Policies

The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.

Bundle	Latest version	Controls covered	Compatible plugin lines
plugin-jira-custom-policies	v0.2.0	none listed	latest

Related

References

• Jira Cloud Platform REST API
• Jira Service Management REST API
• Jira Software REST API