Looking for Guidance on Worker Permissions & Account Structure
Hey all – we’re expanding our use of Cloudflare Workers and running into some issues around permissions granularity.
Specifically: we want to allow our developers to deploy Workers and manage routes on our staging zone (staging.example.com) without giving them access to our production zone (www.example.com). Both zones live under the same Cloudflare Account, and as far as we can tell, permissioning is all-or-nothing across zones – meaning we can’t give access to one without the other.
We’re looking to understand:
- Is there a way to achieve this kind of zone-scoped permissions granularity within a single account?
- Alternatively, should we consider setting up separate Cloudflare Accounts for staging/production, as the Terraform best practices suggest? Link
We're also integrating with GitHub for deployment, so any advice on account/project setup patterns that work well for larger engineering teams would be super helpful.
Cloudflare Docs
Best practices
Though all Terraform deployments are unique, follow these best practices to set yourself up for success.
0 Replies