Description

Ensure environment groups that contain production secrets, such as API keys, passwords, and connection strings, are moved into the production project environment. A scoped environment group can only be linked to services in that environment, so non-production services cannot use production credentials.

Rationale

An environment group that is not scoped can be linked to any service in the workspace, including staging and test services. This makes it easy to accidentally connect a test service to production systems with production credentials. Scoping the group to the production environment prevents this.

Impact

  • Only production services can use production secrets

  • Prevents test services from using production credentials

  • Groups must be organized by environment

Default Value

By default, environment groups are not scoped to an environment and can be linked to any service in the workspace.

Pre-Requisites

  • Workspace Admin role (or Developer for non-protected environments)

  • Production resources organized into a project environment

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Click Environment Groups in the left pane and review each group that holds production secrets.

  3. Check whether each group appears on the production project's overview page (meaning it is scoped to that environment).

  4. If a production group is not scoped, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Click Environment Groups in the left pane and open the environment group's info page.

  3. Click Manage > Move group and select the production project environment.

  4. Confirm the group now appears on the production project's overview page.

  5. Unlink the group from any non-production services and give them their own non-production group.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Click Environment Groups in the left pane, open the group, click Manage > Move group, and move it back out of the environment.

Reference