I have 3 drush-aliased sites: @DEV, @STAGE & @PROD

rsync & sql-sync all work between them. At the moment, that's both directions, between any two sites.

I want to limit the sync paths to only allow sync in the following cases:

  • (1) @DEV -> @STAGE, files & db
  • (2) @STAGE -> @PROD, files & db
  • (3) @PROD -> @DEV, db ONLY

How do I limit drush sync to allow only those three cases of sync, preventing all others?

1 Answer 1


You can do this with a policy file. See examples/policy.drush.inc.

In the example policy file, specific named destinations are rejected. To increase the stability of the system, you could reverse this test to reject any destination except for known good targets, or perhaps some combination -- for example, you could reject sql-sync to any remote destination except @stage.

You probably should not allow sql-sync to @prod, but of course it's up to your policy to decide that. For moving configuration stored in the database, see ctools_export_bonus.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.