# Ensure background workers use environment groups for secrets

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876666209439-ensure-background-workers-use-environment-groups-for-secrets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure background workers get their credentials, such as database URLs and API keys, from an environment group that is scoped to their project environment, instead of values copied by hand into each worker's environment variables.

**Rationale**

When secrets are copied into many services, they are hard to track and rotate, and old copies are often forgotten. An environment group keeps each secret in one place, so it can be updated once for every linked service, and scoping it to an environment stops other environments from using it.

**Impact**

-   Secrets are managed and rotated in one place
    
-   Fewer forgotten copies of credentials
    
-   Workers must be linked to the right group
    

**Default Value**

By default, environment variables are set per service, and environment groups are optional.

**Pre-Requisites**

-   Admin or Developer role (Admin for protected environments)
    
-   An environment group scoped to the worker's environment
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the background worker to open it.
    
3.  Open the Environment page and review its variables and linked environment groups.
    
4.  If secrets are set directly on the worker instead of coming from a scoped environment group, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Click Environment Groups in the left pane, click + New Environment Group (or open an existing one), add the secrets, and move it into the worker's project environment with Manage > Move group.
    
3.  From your workspace home (or project), click the background worker to open it.
    
4.  On the worker's Environment page, under Linked Environment Groups, select the group and click Link, then delete the copied secret variables from the worker.
    
5.  Save the changes and confirm the worker still starts correctly.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the background worker to open it.
    
3.  On the Environment page, add the variables back directly and unlink the environment group.
    

**Reference**

-   [https://render.com/docs/configure-environment-variables](https://render.com/docs/configure-environment-variables)
    
-   [https://render.com/docs/projects](https://render.com/docs/projects)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.