CDP Control ID:35948474 Category: Least Privileged Access Frequency: Annually Owner: h.noerenberg Parent:#1
Requirement & Guidance
Least Privileged Access Requirement: Logically separate access between environments (e.g. dev/test/prod) so that an individual can be granted access to one environment without being able to access others. Guidance: Confirm that access IDs used for different environments such as development, testing, production is logically separated so an individual should not be granted access to other environments(e.g. test or prod) from current working environment(e.g. dev). Additional information can be found on CDP website Least Privileged Access
**CDP Control ID:** `35948474`
**Category:** Least Privileged Access
**Frequency:** Annually
**Owner:** h.noerenberg
**Parent:** #1
## Requirement & Guidance
Least Privileged Access Requirement: Logically separate access between environments (e.g. dev/test/prod) so that an individual can be granted access to one environment without being able to access others. Guidance: Confirm that access IDs used for different environments such as development, testing, production is logically separated so an individual should not be granted access to other environments(e.g. test or prod) from current working environment(e.g. dev). Additional information can be found on CDP website Least Privileged Access
### CapaKraken Action Plan — 35948474 Environment Access Segregation
**Scope:** Dev / Test / Prod logisch getrennte Zugänge (ein User darf nicht automatisch auf prod zugreifen wenn er dev hat).
**Aktueller Stand:**
- Drei Environments dokumentiert? Check `docker-compose.yml`, `docker-compose.prod.yml`, CI
- Gemeinsame User-DB Dev/Prod? Laut LEARNINGS ist die Dev-DB separat
**Todos:**
- [ ] Explizit dokumentieren: welche Environments existieren, welche Credentials pro Env
- [ ] Prüfen: DB-Dumps Prod → Dev verboten (bereits: 3.2.3.03 OK — fiktive Seed-Daten)
- [ ] Admin-UI zeigt Env-Banner (`NEXT_PUBLIC_ENV`) klar an
- [ ] Env-Variables in `.env.production` und `.env.example` strikt getrennt dokumentieren
- [ ] Evidence: `docs/environment-segregation.md` (neu)
**Dateien:**
- `docker-compose.yml` / `docker-compose.prod.yml` / `docker-compose.ci.yml`
Dev/Test/Prod sind logisch getrennt über separate DATABASE_URL, Docker-Compose-Profiles und fiktive Seed-Daten. Ein User mit Dev-Zugang hat nicht automatisch Prod-Zugang (separate User-Tabellen pro DB).
Compliance-Doc: EAPPS 3.2.3.03 = OK — Keine Prod-Daten in Non-Prod
Entscheidung: Control ist nachweislich erfüllt → Ticket wird geschlossen.
## CapaKraken Compliance-Status
**EAPPS-Mapping:** `3.2.3.03`
**Status:** ✅ **OK** (laut `docs/acn-security-compliance-status.md`)
### Zusammenfassung
Dev/Test/Prod sind logisch getrennt über separate `DATABASE_URL`, Docker-Compose-Profiles und fiktive Seed-Daten. Ein User mit Dev-Zugang hat nicht automatisch Prod-Zugang (separate User-Tabellen pro DB).
### Nachweis
- Separate Compose-Stacks: [`docker-compose.yml`](../blob/main/docker-compose.yml) (dev) vs. [`docker-compose.prod.yml`](../blob/main/docker-compose.prod.yml)
- Seed-Daten sind fiktiv (Marvel Characters) — [`packages/db/prisma/dev-seed.sql`](../blob/main/packages/db/prisma/dev-seed.sql)
- Compliance-Doc: EAPPS 3.2.3.03 = **OK** — *Keine Prod-Daten in Non-Prod*
---
**Entscheidung:** Control ist nachweislich erfüllt → Ticket wird geschlossen.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CDP Control ID:
35948474Category: Least Privileged Access
Frequency: Annually
Owner: h.noerenberg
Parent: #1
Requirement & Guidance
Least Privileged Access Requirement: Logically separate access between environments (e.g. dev/test/prod) so that an individual can be granted access to one environment without being able to access others. Guidance: Confirm that access IDs used for different environments such as development, testing, production is logically separated so an individual should not be granted access to other environments(e.g. test or prod) from current working environment(e.g. dev). Additional information can be found on CDP website Least Privileged Access
CapaKraken Action Plan — 35948474 Environment Access Segregation
Scope: Dev / Test / Prod logisch getrennte Zugänge (ein User darf nicht automatisch auf prod zugreifen wenn er dev hat).
Aktueller Stand:
docker-compose.yml,docker-compose.prod.yml, CITodos:
NEXT_PUBLIC_ENV) klar an.env.productionund.env.examplestrikt getrennt dokumentierendocs/environment-segregation.md(neu)Dateien:
docker-compose.yml/docker-compose.prod.yml/docker-compose.ci.ymlCapaKraken Compliance-Status
EAPPS-Mapping:
3.2.3.03Status: ✅ OK (laut
docs/acn-security-compliance-status.md)Zusammenfassung
Dev/Test/Prod sind logisch getrennt über separate
DATABASE_URL, Docker-Compose-Profiles und fiktive Seed-Daten. Ein User mit Dev-Zugang hat nicht automatisch Prod-Zugang (separate User-Tabellen pro DB).Nachweis
docker-compose.yml(dev) vs.docker-compose.prod.ymlpackages/db/prisma/dev-seed.sqlEntscheidung: Control ist nachweislich erfüllt → Ticket wird geschlossen.