Forum Discussion

Sam Thwaites's avatar
Sam Thwaites
Copper Contributor
Nov 14, 2017

Dev / Test / Prod - Subscription per environment or Resource Group per environment?

Hi,

 

So looking back 2 years, the general idea was to create a subscription per environment to secure resources from the unintended.

 

However, with the new RBAC model - it now looks like (for small shops) some people are recommending one subscription with a resource group per environment because you can now lock these down via roles. E.g. Some dev's cant access or even see the "Production" resource group.

 

We are a small startup so we don't want large overheads, but we also don't want to go down some path that will box us in down the track.

 

Does anyone have any words of wisdom?

 

Cheers,
Sam

security
  • Gustavo Magella [MVP]'s avatar
    Gustavo Magella [MVP]
    MVP
    Nov 14, 2017

    Hello Sam! With RBAC you can grant or revoke access for all of your members of your team.

     

    So, for some resources, you can block create, delete, etc.

     

    The permissions are:

     

    Owner: Has full access to resources and can delegate access to other users.

     

    Contributor: Has the same permissioning pattern as the Owner, but can not delegate access to other users.

     

    Reader: Only displays the features in a signature. (Can not create, delete, move, resize, etc)

     

    So, YES! You can use RBAC to help you on manage coasts.

     

    Big hug!

Resources