HN Explorer

Ask HN: How many engineers have direct access to production where you work?

6 points by fouadmatin ↗ HN
I've seen situations where everyone on the engineering team have direct SSH access to the production database and other cases where practically no one does, and everything is done through GitOps or similar peer-reviewed migrations. Curious what have you seen when it comes to production access?

10 comments

[ 4.1 ms ] story [ 40.4 ms ] thread
helsontaveras18
2/5 engineers. SOC 2 compliance forces us to use automation and peer reviewed actions as much as possible, which may slow you down in the short term, but improves reliability and security in the long run.
browningstreet
I work in a highly regulated environment. Big company.

The DBA team sets up databases and service accounts. They give those accounts to the developers. The two can’t do each others’ jobs. It helps that we are regularly audited.

Have also worked at a startup where things where as you described. I ended that immediately. It took us some time to figure out who needed what and how we could accommodate proper controls.

It really depends on circumstances, but start thinking in terms of “blast radius”.

CommanderData
We've had very segmented access for all of our Ops people. It took a while to get used to and made alot of sense at the time.

Any privileged access is done through our jump boxes.

However there are times where we need full access to production like some of our applications would which makes us question the whole point of the excerise.

schrodinger
Company with hundreds of engineers, we all have access, but we need to (a) raise a ticket explaining why we need it and (b) have a peer (note: peer, not manager or something) confirm. And if you're on-call this doesn't aply.
giaour
I work at a bigtech company, and, depending on how you look at it, either everyone in a technologist role has prod access or nobody does. You have to get peer approval to access your team's sliver of prod, and some team's take this very seriously, while others act as rubber stamps for each other.
catchnear4321
Wait wait hang on… I’m confused. I was with you on the “everyone has prod access” but then you went and qualified it with teams owning slivers of something or other.

That doesn’t sound like full access to production.

I bet they didn’t even have cloud console admin.

giaour
No one has access to literally everything. I work for a cloud provider with hundreds of products, tens of regions, and multiple isolated "clouds"; the "full access to production" you allude to only exists at companies too new to have developed formal access policies and too small to have gotten the attention of regulators.

Each team that owns a service has access to the prod environment(s) for said service (including the cloud console, a shell on a prod machine with admin privileges, etc) provided they get peer approval for the access they need.

catchnear4321
It varies, and it can ebb and flow at a single company, in a single business unit even.

Some of the… more permissive arrangements have been rather… fascinating.

Some of the supposedly well regulated ones were more like cults. Bring your completed forms, receive your foolishly named certification. Oh the things the forms are asking about? Nah it doesn’t really matter. Understand the requirements? You bet. There’s only one. Complete those forms. Get that star.

Not sure I have ever seen it done well. Certainly some places far better than others.

simonblack
Define 'engineers'. Are you going to use the specific meaning or the inaccurate, wider usage of the term? (as in the meaningless, poorly-specified 'software engineers')