What is the best practice for separating responsibilities and access for production and development environments?

Question

Options

• ASeparate project for each environment, each team only has access to their project.
• BSeparate project for each environment, both teams have access to both projects.
• CBoth environments use the same project, but different VPC's.
• DBoth environments use the same project, just note which resources are in use by which group.

• A
  78% (25)
• B
  6% (2)
• C
  3% (1)
• D
  13% (4)

Explanation

Separating environments into distinct projects with role-based access control (option A) enforces the principle of least privilege - developers only touch dev, and only authorized personnel access production, minimizing accidental changes or data exposure. Option B is wrong because giving both teams access to both projects defeats the purpose of isolation, leaving production vulnerable to developer mistakes. Option C is wrong because shared projects still share IAM policies, billing, and audit logs, meaning a misconfigured permission can bleed across environments regardless of VPC separation. Option D is the worst approach - relying on informal notes instead of enforced boundaries is not a security control and creates serious risk of human error in production.

Memory tip: Think "separate keys for separate doors" - if prod and dev share a project, they share a keyring. Separate projects = separate keyrings, so a dev with the wrong key simply can't get in.

No community discussion yet for this question.