Open RupertBarrow opened 4 months ago
@RupertBarrow thank you for your feature suggestion. Have you seen the Lock App option? This is available for Enterprise customers. I assume this option may not be granular enough for your needs.
Thanks @andre5oto , I didn't know about that feature. It does not address precisely my requirement, and is only available in the Entreprise license.
How about a "Lock Dashboard" option or extending the Lock App option to all customers? But it looks like you're looking for precise permissions in your pipeline. If we extended the permissions model we have for Enterprise to all users, would that be closer to what you seek?
This is a UI-vs-automation feature, so Lock Dashboard (or a similar finer-grain option) sounds good.
Changing configuration via souce code updates of files such as app.json or Procfile should still be allowed.
Thanks @RupertBarrow, I think I understand now. The proposal is for a UI option to lock a particular pipeline (e.g., staging, development, production) for an app vs. just locking the entire app. I will add this to our Heroku product backlog.
Required Terms
What service(s) is this request for?
Heroku dynos
Tell us about what you're trying to solve. What challenges are you facing?
The same way Github has a feature to "protect a main branch" to avoid unexpected and uncontrolled operation on this important branch, it would be nice for Heroku to let admins "protect an app" to disable changes to the app settings via the UI.
For example, in a pipeline where you have a development version of the app, a staging version and a production version :
These settings would be at least config vars and buildpacks. The idea is to control changes to these settings and make sure that they are traced either via changes to a version-controlled file (such as app.json) or that they are triggered by a CI operation via the Heroku CLI (or API integration with the Heroku API).
Admins could be able to change these settings themselves, which would mean, indeed, that they could toggle this access permission off then on again to change something via the UI; the idea of this feature is to avoid errors. For security-centered organizations, it could be possible to remove the possibility for some non-super admins to change these app access permissions.