Protected environments (PREMIUM)

Introduced in GitLab Premium 11.3.

Environments can be used for different reasons:

• Some of them are just for testing.
• Others are for production.

Since deploy jobs can be raised by different users with different roles, it is important that specific environments are "protected" to prevent unauthorized people from affecting them.

By default, a protected environment does one thing: it ensures that only people with the right privileges can deploy to it, thus keeping it safe.

NOTE: A GitLab admin is always allowed to use environments, even if they are protected.

To protect, update, or unprotect an environment, you need to have at least Maintainer permissions.

Protecting environments

To protect an environment:

1. Navigate to your project's Settings > CI/CD.
2. Expand the Protected environments section.
3. From the Environment dropdown menu, select the environment you want to protect.
4. In the Allowed to Deploy dropdown menu, select the role, users, or groups you want to give deploy access to. Keep in mind that:
   • There are two roles to choose from:
     • Maintainers: Allows access to all maintainers in the project.
     • Developers: Allows access to all maintainers and all developers in the project.
   • You can only select groups that are already associated with the project.
   • Only users that have at least the Developer permission level appear in the Allowed to Deploy dropdown menu.
5. Click the Protect button.

The protected environment now appears in the list of protected environments.

Use the API to protect an environment

Alternatively, you can use the API to protect an environment:

1. Use a project with a CI that creates an environment. For example:

   stages:
     - test
     - deploy
   
   test:
     stage: test
     script:
       - 'echo "Testing Application: ${CI_PROJECT_NAME}"'
   
   production:
     stage: deploy
     when: manual
     script:
       - 'echo "Deploying to ${CI_ENVIRONMENT_NAME}"'
   environment:
     name: ${CI_JOB_NAME}

2. Use the UI to create a new group. For example, this group is called protected-access-group and has the group ID 9899826. Note that the rest of the examples in these steps use this group.

   

3. Use the API to add a user to the group as a reporter:

   $ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --data "user_id=3222377&access_level=20" "https://gitlab.com/api/v4/groups/9899826/members"
   
   {"id":3222377,"name":"Sean Carroll","username":"sfcarroll","state":"active","avatar_url":"https://assets.gitlab-static.net/uploads/-/system/user/avatar/3222377/avatar.png","web_url":"https://gitlab.com/sfcarroll","access_level":20,"created_at":"2020-10-26T17:37:50.309Z","expires_at":null}

4. Use the API to add the group to the project as a reporter:

   $ curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" --request POST "https://gitlab.com/api/v4/projects/22034114/share?group_id=9899826&group_access=20"
   
   {"id":1233335,"project_id":22034114,"group_id":9899826,"group_access":20,"expires_at":null}

5. Use the API to add the group with protected environment access:

   curl --header 'Content-Type: application/json' --request POST --data '{"name": "production", "deploy_access_levels": [{"group_id": 9899826}]}' --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.com/api/v4/projects/22034114/protected_environments"

The group now has access and can be seen in the UI.

Environment access by group membership

A user may be granted access to protected environments as part of group membership. Users with Reporter permissions, can only be granted access to protected environments with this method.

Deployment branch access

Users with Developer permissions can be granted access to a protected environment through any of these methods:

• As an individual contributor, through a role.
• Through a group membership.

If the user also has push or merge access to the branch deployed on production, they have the following privileges:

• Stopping an environment.
• Delete a stopped environment.
• Create an environment terminal.

Deployment-only access to protected environments

Users granted access to a protected environment, but not push or merge access to the branch deployed to it, are only granted access to deploy the environment.

Note that deployment-only access is the only possible access level for users with Reporter permissions.

Modifying and unprotecting environments

Maintainers can:

• Update existing protected environments at any time by changing the access in the Allowed to Deploy dropdown menu.
• Unprotect a protected environment by clicking the Unprotect button for that environment.

After an environment is unprotected, all access entries are deleted and must be re-entered if the environment is re-protected.

For more information, see Deployment safety.