Description

Ensure production Key Value instances belong to a project environment marked Protected, so that only Admins can view their passwords and connection URLs, change their IP access list, or delete them.

Rationale

Key Value credentials give access to sessions, tokens, and queued jobs, and deleting the instance causes data loss. In an unprotected environment, any Developer can view credentials or open external access. Protection limits these actions to Admins.

Impact

  • Only Admins can view credentials or change access

  • Reduces the risk of data exposure or loss

  • Developers need an Admin for some tasks

Default Value

By default, Key Value instances are not in a protected environment.

Pre-Requisites

  • Workspace Admin role

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Key Value instance to open it.

  3. Check which project environment the instance belongs to, and whether that environment shows the Protected label.

  4. If it is not in a protected environment, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Open the Key Value instance's ••• menu and click Move, then select the production project environment.

  3. From your workspace home, open the project and scroll to the production environment.

  4. Click the ••• menu at the top right of the environment, then click All settings.

  5. In the Permissions section, click Edit, select Protected, and click Save.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home, open the project and scroll to the production environment.

  3. Click the ••• menu at the top right of the environment, then click All settings.

  4. In the Permissions section, click Edit, remove protection, and click Save.

Reference