This page describes how to create connections to Bitbucket Cloud and create links to Bitbucket Cloud repositories. You can complete these tasks using the Google Cloud console, or the Google Cloud CLI.

<br />

These instructions are for application developers, platform administrators, and
security managers who want to use Bitbucket Cloud source code repositories with Google.
Specifically, you can use Bitbucket Cloud repositories with
[Gemini Code Assist](https://docs.cloud.google.com/gemini/docs/codeassist/code-customization-overview).

To learn more about Developer Connect, see
[Developer Connect overview](https://docs.cloud.google.com/developer-connect/docs/overview).

## Before you begin

1. Ensure that you have access to an account on [Bitbucket Cloud.](https://bitbucket.org/)

   To help keep your team's work secure, we recommend that you complete the
   tasks in this guide using a bot account or an account shared by your team, not
   a personal account.
2. Ensure that you own a Bitbucket Cloud repository, or have admin-level permissions on a shared repository.
3. Optional: Create a [customer-managed
   encryption key](https://docs.cloud.google.com/kms/docs/create-key) (CMEK) for encrypting the authentication secrets that Developer Connect creates.
4. Optional: To use the command-line instructions in this guide, complete the following steps:
   1. Install the [Google Cloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk). If you've installed gcloud CLI previously, make sure you have the latest available version by running `gcloud components update`.
   2. Create a [Developer Connect service account](https://docs.cloud.google.com/developer-connect/docs/access-control#sa) by running the following command, where <var translate="no">PROJECT_ID</var> is your [Google Cloud project ID](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects):

      ```bash
              gcloud beta services identity create \
                  --service=developerconnect.googleapis.com \
                  --project=PROJECT_ID
              
      ```

### Required roles


To get the permissions that
you need to create connections and links,

ask your administrator to grant you the
following IAM roles:

- If you aren't the project owner: [Developer Connect Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/developerconnect#developerconnect.admin) (`roles/developerconnect.admin`) on your user account.
- If you plan to use a CMEK to encrypt the secrets that Developer Connect creates: [Cloud KMS CryptoKey Encrypter/Decrypter](https://docs.cloud.google.com/iam/docs/roles-permissions/cloudkms#cloudkms.cryptoKeyEncrypterDecrypter) (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) on the Secret Manager Service Account.
- If you plan to use the gcloud CLI to complete the steps in this guide: [Secret Manager Admin role](https://docs.cloud.google.com/iam/docs/roles-permissions/secretmanager#secretmanager.admin) (`roles/secretmanager.admin`) on the Developer Connect Service Account.
- If you plan to use the Google Cloud console to complete the steps in this guide: [Project IAM Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`) on your user account.


For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).


You might also be able to get
the required permissions through [custom
roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles) or other [predefined
roles](https://docs.cloud.google.com/iam/docs/roles-overview#predefined).

> [!NOTE]
> **Note:** When you have the Project IAM Admin (`roles/resourcemanager.projectIamAdmin`) role, the Google Cloud console can automatically grant necessary permissions on your behalf. If your administrator won't allow you to have the Project IAM Admin role, then ask your administrator to grant Secret Manager Admin (`roles/secretmanager.admin`) on the Developer Connect Service Account (`service-{projectNumber}@gcp-sa-devconnect.iam.gserviceaccount.com`).

## Create access tokens

Create personal access tokens in Bitbucket Cloud by completing the following steps:

1. [Sign in to Bitbucket Cloud](https://bitbucket.org/).

2. Complete the following steps to create two access tokens in Bitbucket Cloud. These
   can be
   [Repository Access Tokens](https://support.atlassian.com/bitbucket-cloud/docs/repository-access-tokens/),
   [Project Access Tokens](https://support.atlassian.com/bitbucket-cloud/docs/project-access-tokens/), or
   [Workspace Access Tokens](https://support.atlassian.com/bitbucket-cloud/docs/workspace-access-tokens/).

   1. Choose the instructions for the type of access token you will use:

      - [Create Repository Access Tokens](https://support.atlassian.com/bitbucket-cloud/docs/create-a-repository-access-token/)
      - [Create Project Access Tokens](https://support.atlassian.com/bitbucket-cloud/docs/create-a-project-access-token/)
      - [Create Workspace tokens](https://support.atlassian.com/bitbucket-cloud/docs/create-a-workspace-access-token/)
   2. Create the first token with the following scopes:

      - **Repositories** : **read**.
      - **Pull Requests** : **read**.
      - **Webhooks** : **read** and **write**.

      In Developer Connect, this is called your
      *Authorizer access token*.
   3. Create the second token with the following scope:

      - **Repositories** : **read**.

      In Developer Connect, this is called your *Read access token*.

   You are responsible for managing token lifetimes in Bitbucket Cloud. Bitbucket Cloud tokens
   have no expiry and will remain valid until you revoke them.

   Some types of Bitbucket tokens are premium features exclusively available
   in paid plans. For more information, see
   [Bitbucket Cloud tokens](https://support.atlassian.com/bitbucket-cloud/docs/access-tokens/).
3. Copy the access tokens for use in the following procedures.

## Create a connection

This section describes how to create a connection between Developer Connect
and Bitbucket Cloud. If you're using the Google Cloud console, then you can also start
adding links to repositories as you finish setting up your connection.

To create a new Bitbucket Cloud connection, select one of the following options:

### Console

Initiate a connection by completing the following steps:

1. In the Google Cloud console, open **Developer Connect**.


   [Go to Developer Connect](https://console.cloud.google.com/developer-connect/connections)

   <br />

   Developer Connect displays the **Git repositories** page.
   - **If you see a list of source code management providers:** Start configuring your first connection by selecting a source code management provider. Click **Connect** on the Bitbucket Cloud card.
   - **If you see a table listing existing connections** : Set the source
     code management provider by clicking **Create connection** \>
     **Bitbucket Cloud**.

     The **Create Connection** page opens.
2. For **Region** , choose a [region](https://docs.cloud.google.com/developer-connect/docs/locations)
   for your connection resources.

   1. For **Name**, enter a name for your new connection.
3. For **Workspace** , enter your [Bitbucket Cloud workspace ID](https://support.atlassian.com/bitbucket-cloud/docs/what-is-a-workspace/).

4. In the **Access Tokens** section, enter your Bitbucket Cloud access tokens:

   - **Authorizer access token** : Enter your [authorizer access
     token](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#tokens).
   - **Read access token** : Enter your [read access token](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#tokens).
5. Click **Show more** to see optional configuration settings.

   1. Optional: In the **Encryption** section, select a
      [CMEK key](https://docs.cloud.google.com/kms/docs/key-management-service) to
      encrypt Secret Manager secrets that Developer Connect
      creates.

   2. Optional: By default, Developer Connect can act as a proxy for Git calls to Bitbucket Cloud.
      To disable this option, clear the **Enable Developer Connect proxy**
      checkbox.

6. To finish configuring your connection, click the **Continue** button.

   Developer Connect creates your connection. This process can take a
   few seconds.

Once the connection is created, the **Link repositories** page appears.

Complete the following steps to link repositories to your connection:

1. In the list of available repositories, select the repositories
   you want to use.

2. Click **OK**.

3. Click **Link**.

Your connection is added to the **Connections** page and your repository
links are added to the **Repositories** page in the Google Cloud console.
You can [add more links to existing connections](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#link-repos) at any time.

If you're setting up Gemini Code Assist, continue the process
by following the steps in
[Configure and use Gemini Code Assist code customization](https://docs.cloud.google.com/gemini/docs/codeassist/code-customization).

### gcloud

1. Create a webhook secret in Secret Manager by running the
   following command, where <var translate="no">WEBHOOK_SECRET_NAME</var> is a name for
   your webhook secret:

       cat /proc/sys/kernel/random/uuid | tr -d '\n' | gcloud secrets create WEBHOOK_SECRET_NAME

2. Store your personal access tokens in Secret Manager by running
   the following commands:

       gcloud secrets create AUTHORIZER_SECRET_NAME

       echo -n AUTHORIZER_SECRET_DATA | gcloud secrets versions add AUTHORIZER_SECRET_NAME --data-file=-

       gcloud secrets create READ_SECRET_NAME

       echo -n READ_SECRET_DATA | gcloud secrets versions add READ_SECRET_NAME --data-file=-

   Replace the following:
   - <var translate="no">AUTHORIZER_SECRET_NAME</var>: a name for the secret where Secret Manager stores your [authorizer access token](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#tokens).
   - <var translate="no">AUTHORIZER_SECRET_DATA</var>: your authorizer access token.
   - <var translate="no">READ_SECRET_NAME</var>: a name for the secret where Secret Manager stores your [read access token](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#tokens).
   - <var translate="no">READ_SECRET_DATA</var>: your read access token.
3. Run the
   [`gcloud developer-connect connections create`](https://docs.cloud.google.com/sdk/gcloud/reference/developer-connect/connections/create) command to create a connection to Bitbucket Cloud:

       gcloud developer-connect connections create CONNECTION_NAME \
           --location=REGION \
           --bitbucket-cloud-config-authorizer-credential-user-token-secret-version=projects/PROJECT_ID/secrets/AUTHORIZER_SECRET_NAME/versions/VERSION \
           --bitbucket-cloud-config-read-authorizer-credential-user-token-secret-version=projects/PROJECT_ID/secrets/READ_SECRET_NAME/versions/VERSION \
           --bitbucket-cloud-config-webhook-secret-version=projects/PROJECT_ID/secrets/WEBHOOK_SECRET_NAME/versions/VERSION \
           --git-proxy-config-enabled

   Replace the following:
   - <var translate="no">CONNECTION_NAME</var>: a name for your connection.
   - <var translate="no">REGION</var>: the [region](https://docs.cloud.google.com/developer-connect/docs/locations) to use for your connection.
   - <var translate="no">PROJECT_ID</var>: your Google Cloud [project ID](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects#get_an_existing_project).
   - <var translate="no">AUTHORIZER_SECRET_NAME</var>: the name of the Secret Manager secret that contains your authorizer-level token from Bitbucket Cloud.
   - <var translate="no">READ_SECRET_NAME</var>: the name of the Secret Manager secret that contains your read-only token from Bitbucket Cloud.
   - <var translate="no">WEBHOOK_SECRET_NAME</var>: the name of the Secret Manager secret that contains your webhook secret.
   - <var translate="no">VERSION</var>: the version number of each secret. This can be `latest` to use the most recent version number.
   - `--git-proxy-config-enabled`: an optional flag that enables Developer Connect to act as a proxy for Git calls to Bitbucket Cloud. This capability is in [Preview](https://cloud.google.com/products/#product-launch-stages).

   Developer Connect completes the connection to Bitbucket Cloud. Next,
   [link to repositories](https://docs.cloud.google.com/developer-connect/docs/connect-bitbucket-cloud#link-repos).

## Link to repositories using an existing connection

Once you have established a connection to Bitbucket Cloud, you can link to
repositories. You can repeat these steps later to link additional repositories
as needed.

To create repository links on an existing Bitbucket Cloud connection, select one of the
following options:

### Console

Create links to repositories by completing the following steps:

1. Open the **Repositories** page in the Google Cloud console.

   [Open the **Repositories**
   page](https://console.cloud.google.com/developer-connect/git-repository-links)
2. Click **Link repository**.

   The **Link Git repositories** pane opens.
3. In the connections list, choose a connection.

4. Click **Continue**.

5. In the repositories list, select the repositories you want to link to.

   Developer Connect displays suggested names for your repository
   resources.
6. Select a repository resource naming option:

   - **Generated**: Use the generated repository resource names.
   - **Manual**: Input names of your own.
7. Click **Create**.

   Developer Connect creates the repository links and displays them in
   the Google Cloud console.

### gcloud

Create a link to your Bitbucket Cloud repository by running the following command:

    gcloud developer-connect connections git-repository-links create REPO_NAME \
        --clone-uri=REPO_URI \
        --connection=CONNECTION_NAME \
        --location=REGION

Replace the following:

- <var translate="no">REPO_NAME</var>: a name for the new link between Developer Connect and your Bitbucket Cloud repository.
- <var translate="no">REPO_URI</var>: the URL of your repository in Bitbucket Cloud, including the `https://` prefix and the `.git` suffix.
- <var translate="no">CONNECTION_NAME</var>: the name of your connection to Bitbucket Cloud.
- <var translate="no">REGION</var>: the region of your connection.

Developer Connect creates the repository links.

To list linked repositories, run the
[`developer-connect connections git-repository-linkslist`](https://docs.cloud.google.com/sdk/gcloud/reference/developer-connect/connections/git-repository-links/list)
command.

If you're setting up Gemini Code Assist, continue the process
by following the steps in
[Configure and use Gemini Code Assist code customization](https://docs.cloud.google.com/gemini/docs/codeassist/code-customization).

## What's next

- [Finish setting up Gemini Code Assist code customization](https://docs.cloud.google.com/gemini/docs/codeassist/code-customization).
- [Learn how Gemini Code Assist helps you accelerate software development](https://docs.cloud.google.com/gemini/docs/codeassist/overview).
- [Explore other integrations available through Developer Connect.](https://docs.cloud.google.com/developer-connect/docs/overview)