# Ensure production Key Value instances are in a protected environment

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876670184412-ensure-production-key-value-instances-are-in-a-protected-environment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure production Key Value instances belong to a project environment marked Protected, so that only Admins can view their passwords and connection URLs, change their IP access list, or delete them.

**Rationale**

Key Value credentials give access to sessions, tokens, and queued jobs, and deleting the instance causes data loss. In an unprotected environment, any Developer can view credentials or open external access. Protection limits these actions to Admins.

**Impact**

-   Only Admins can view credentials or change access
    
-   Reduces the risk of data exposure or loss
    
-   Developers need an Admin for some tasks
    

**Default Value**

By default, Key Value instances are not in a protected environment.

**Pre-Requisites**

-   Workspace Admin role
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Key Value instance to open it.
    
3.  Check which project environment the instance belongs to, and whether that environment shows the Protected label.
    
4.  If it is not in a protected environment, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Open the Key Value instance's ••• menu and click Move, then select the production project environment.
    
3.  From your workspace home, open the project and scroll to the production environment.
    
4.  Click the ••• menu at the top right of the environment, then click All settings.
    
5.  In the Permissions section, click Edit, select Protected, and click Save.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home, open the project and scroll to the production environment.
    
3.  Click the ••• menu at the top right of the environment, then click All settings.
    
4.  In the Permissions section, click Edit, remove protection, and click Save.
    

**Reference**

-   [https://render.com/docs/projects](https://render.com/docs/projects)
    
-   [https://render.com/docs/key-value](https://render.com/docs/key-value)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.