Description

Ensure only a small, approved number of members, at least 2 and no more than 3, have the Admin role in the Render workspace. All other members should have the lowest role that meets their needs, such as Developer, Contributor, Viewer, or Billing.

Rationale

Admins can add and remove members, change roles, enforce or disable login rules, mark environments as protected, and delete protected resources. Each extra Admin is another account that could be compromised or misused. Keeping two or three Admins avoids a single point of failure while limiting privileged access.

Impact

  • Fewer accounts with full control of the workspace

  • Reduces the impact of a compromised account

  • At least two Admins remain to avoid lockout

Default Value

The person who creates the workspace is assigned the Admin role. Render does not limit how many members can be Admins.

Pre-Requisites

  • Workspace Admin role

  • A list of approved Admins

  • Pro plan or higher to have multiple members (the Contributor, Viewer, and Billing roles require Scale or higher)

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Scroll down to the Team members section and count the members with the Admin role.

  4. If there are fewer than 2 or more than 3 Admins, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. In the Team members section, click the current role of each member who does not need the Admin role and select Developer (or another lower role available on your plan).

  4. If there is only one Admin, give the Admin role to one more trusted member.

  5. Confirm that 2 to 3 Admins remain.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. In the Team members section, click the member's current role and select Admin.

Reference