Separating different deployment stages into different projects on Google Cloud Platform

Question

I'm working on a project that we will deploy to Google Cloud Platform. The services we want to use include cloud run, SQL, and cloud storage.

We will use several deployments for different phases of development; namely development, staging, and production.

I'm worried about security mostly regarding who can access what. Obviously, we want our developers to have some access to the development environment so that they may tweak things, create temporary databases, and perform other tasks that may be necessary to help in development. However, the production environment is naturally more protected and not everyone should have access to its settings.

One solution I thought of was creating a separate project for each environment. However, I believe this might not be the correct course of action. What is your suggestion for this? Basically what we would like is separate environments with their own firewall and access controls.

Thanks!

Answer 1

You could duplicate all your deployments for each stage, but passing differents variable at the beginning of the deployment of each that configure different access and level of securities, meaning different level of liberties.

But if you do that, that's mean you have to update each environment, each time you update one. So you must firstly write independent component that you can reuse with differents parameters (dev, staging, prod).