Security with roles, network and keys

People

Give least privilege on IAM: Admin, Developer, Billing, Viewer, with Selected Projects where possible. Removing a member revokes keys they issued. Everyone should turn on two-step sign-in.

Network

Network Access: add IPs with + Add IP Address / CIDR, include your own, then Enforce IP Lockdown Now. Depending on your database it is enforced at the pooler or applies to function calls only; the page says which. Verify with Connection Check.

Keys

Publishable keys only in clients, with RLS on every exposed table. Secret keys only on servers in environment variables. Rotate by generating a new key then Revoke. Rotate the database role key via Rotate Role Key if leaked. Use Revoke all API keys in an incident.

Moving a project

A transfer to another organization does not rotate keys. The new owner must rotate keys, role keys and secrets and reconnect GitHub.

Practice

Review IAM today and remove anyone who no longer needs access.

Recap

• People, network, keys: three layers.
• Rotate after any exposure.