Developers have no standing production access; deployments via pipeline only

Production deployments to AWS run only through the GitHub Actions pipeline with protected environments; developers have no standing write access to production accounts.

Requirements

ISO-A.8.31 A.8.31 · Separation of development, test and production environments

ITGC-CM-03 ITGC-CM-03 · Segregation between development and production

RBI-ITGRCA-2023-7.4 RBI-ITGRCA-2023 §7.4 · Change and patch management — documented, approved and tested changes (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)

SOC2-CC6.1 CC6.1 · Logical access security software, infrastructure and architectures

SOC2-CC8.1 CC8.1 · Authorizes, designs, tests, approves and implements changes

Policy

pol-change · Change Management Policy

Applications

Amazon Web Services (ap-south-1)GitHub Enterprise Cloud

Third parties

—

Testing procedure

GitHub environments + OIDC deploy role; IAM permission set design. Tests: GitHub Enterprise Cloud: Production environment requires reviewers; Amazon Web Services (ap-south-1): No developer roles with prod write. Frequency continuous.