Description

Ensure the workspace enforces two-factor authentication (2FA) from Workspace Settings, so that members who have not enabled 2FA cannot access the workspace's resources or settings, and their SSH keys and API keys also stop working for workspace resources until they enable 2FA.

Rationale

Asking people to enable 2FA is not enough, because some accounts are always missed. Enforcement makes 2FA mandatory: any member without it is blocked, including their API and SSH keys. This guarantees that every account with access to the workspace has a second factor, even new members.

Impact

  • Members without 2FA are blocked from workspace resources

  • API and SSH keys of members without 2FA stop working for the workspace

  • Members must enable 2FA before they can continue working

Default Value

By default, 2FA is not enforced for a workspace.

Pre-Requisites

  • Workspace Admin role

  • Members informed in advance so they can enable 2FA

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Find the two-factor authentication enforcement setting and verify that it is enabled.

  4. If 2FA is not enforced, follow the implementation steps.

Implementation Steps

  1. Ask all members to enable 2FA on their own accounts first, to avoid blocking their work.

  2. Sign in to the Render Dashboard at https://dashboard.render.com.

  3. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  4. Turn on the setting to enforce two-factor authentication for the workspace and confirm.

  5. Check with members that they can still access the workspace.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Turn off two-factor authentication enforcement for the workspace.

Reference