is it best practice to have dedicated user for deployment?

[pc7900]

Our servers are DigitalOcean droplets for both dev and prod. We also have both a Marketing site (WordPress) and an app (Laravel) in separate bitbucket repositories.  We're not yet to the stage that we want to use Pipelines for our deployment.  Our developer wants to keep it simple at this point as we are at the MVP stage.

That being said, I want to at least take steps towards a more generic approach where we are not tied to our contracted developer's DigitalOcean user.  I've seen recommendations to set up a dedicated deployment user which does sound like a good idea.  Let's call this user deploy. 
- Can I use this deploy user on both dev and prod or would it be best to have a deploy_dev user and a deploy_prod user (from a bitbucket perspective?)
- Can/should I use the same user for both repository deployments?

[Jimmy Seddon · Accepted solution]

Hi @pc7900,

That depends on who is capable of performing the various deployments in your environment.  For us any developer can deploy to the dev environment whenever they want, and our developers know that they need to communicate with each other at this is a anything goes testing environment.  However, the same is not true about our production environment, and for that reason we use a seperate deployment user and we have different permission groups to be absolutely sure that no one accidentally affects production.

I don't know if that really helped, I would recommend user seperate users for safety sake but it depends what your company is comfortable with.

-James

[pc7900]

Thanks ... That actually makes a lot of sense to me... having a separate user for each.