Securing app access on a user basis

[nick1]

We are wondering what status of limiting users to certain permissions such as viewing an app and the ability to ssh into it?

Our use case is that we have production data that our entire org shouldn’t have access to, but as it is today being able to SSH with flyctl gives any member or admin access to ENV vars and the apps console. Is there anything in the roadmap to limit this access?

[greg]

Certainly seems like it’s in the roadmap, but not sure when e.g:

Feature Request: Limit access tokens to certain organizations

We’ve been working on that. Specifically being able to scope the permissions of tokens. For instance, creating a metrics:read scoped token for Grafana or a logs:read for accessing and forwarding logs. Not sure when it’ll happen exactly, but this is on the roadmap!