Best practices for security roles when using ChaRM

[tami]

Is it best practice to move all security role transports to production even the transports that are only needed to go to Integration systems? We are implementing ChaRM and are trying to determine if we now need to send every transport whether needed or not. We develop roles for each environment (dev, QA, pre-prod, prod) and only move them to that environment (ex. integration roles would not be used in prod so we do not transport these roles to prod). In addition, for projects we transport roles to Integration for testing, these transports do not go to production. Instead, prior to go live we create a new transport and send to production. Trying to find out when using ChaRM if security roles should be always be transported to production to close the lifecycle of the ChaRM Change request? Or have folks made changes to the standard ChaRM configuration to handle role transports?

[TammyPowlas]

Hi Tami - we always use transports with security roles, even if they do not move to production. I don't know if that is a "best practice" but in all the positions I've held, that's what we have done.

[tami]

Thanks - yes, we use transports to move roles as well. My question is do you keep all of your roles in production and therefore you always move all security transports to production (e.g., do you move roles built for QA system to production)? Today we often stop a transport in QA if the role is not needed in prod. Or for projects, instead of moving a bunch of transports that were used to move roles to QA for integration testing, we will go back to dev core client and create a new transport to move those role changes up the landscape. Do you use ChaRM?

[TammyPowlas]

Yes we use Charm

But we don't move QA-only roles to production

[tami]

Hi Tammy,

Good to know. We are in the middle of implementing ChaRM. We are being told the transports within the ChaRM Request should be transported all the way to production to complete the cycle; should not be withdrawn after moving to QA.

Question: for your transports to QA that don't move to production, what is your ChaRM process for the transports that do not need to move to production as only required in QA (e.g., withdraw the ChaRM request after transport moves to QA)?

Thanks,

Tami

[TammyPowlas]

We leave some "orphan" transports

[tami]

Thank you.

How do you handle your ChaRM requests that contain transports than stop in QA system?