Information for: DEVELOPERS   PARTNERS

Requirements for Remote Administration

To efficiently troubleshoot subscriber websites, update modules, and implement fixes, Acquia Support requires several tools and Drupal modules. The absence of these tools and modules can delay the delivery of Acquia Remote Administration (RA) services.

Acquia’s security update automation has specific requirements. Ensuring your website complies with these requirements will ensure the efficient delivery of security updates.


For Acquia to have access to your websites, be aware of the following:

  • Subscribers must give Acquia administrative-level access to all systems and accounts required to perform Remote Administration tasks.
  • Acquia will perform RA services from its own premises using remote electronic access to subscriber’s systems and accounts.
  • Acquia requires access to one or more development/testing servers to ease the testing and deployment of updates in connection with this service.
  • Acquia will assist with configuring two QA/development/test servers to support the test and deployment process using a code repository and revision control.
  • Acquia will deploy a Remote Administration environment for each subscription which is used solely for the deployment of automated security updates by Acquia.
  • To administer your website from the user interface, Acquia requires an administrative-level user account on your Drupal website.
  • Acquia requires full access to your Acquia VCS repository.
  • For Acquia Cloud Site Factory subscribers only, Acquia requires a list of representative websites to stage, as described in Special considerations for Acquia Cloud Site Factory.

Drupal and Module Requirements

Remote Administration has the following requirements for Drupal and its associated modules.


  • Each RA subscription may contain a single installation of Drupal. More than one install of Drupal is not supported.
  • The Drupal installation must be located in [reponame]/docroot. A symlinked docroot directory (typically to a vendor or www) is supported. Drush is required to work on all environments without error.

Module installation

Acquia strongly encourages the implementation of Drupal best practices regarding module installation.

  • The default location of contributed modules must be [reponame]/docroot/sites/all/modules for Drupal 7 websites or [reponame]/docroot/modules for Drupal 8 websites. Modules can be sorted into contrib and custom if desired.
  • Modules which must be available to only one Drupal 7 website within a subscription can be installed in [reponame]/docroot/sites/sitename/modules. This module will be inaccessible to all other websites.
  • Duplicate modules must be avoided unless a particular website must use a specific module version. In this case, the module must be in the website-specific module folder, and must be locked to avoid automated updates.

Required modules

Acquia Remote Administration has no specific module requirements for receiving updates. However, Acquia strongly recommends you install and enable the following module to assist with troubleshooting updates:

Clean core and contributed modules

As Remote Administration doesn’t cover modified core or contributed modules, Acquia recommends you implement any customizations using custom modules or theming files. This allows the Remote Administration team to implement updates, while allowing the subscriber development team to change custom code without any loss of modifications.

If your website requires modification of Drupal core, or contributed modules, refer to Patching and locking modules to ensure your website remains compatible with Acquia security updates.


Drush is required by RA automation to apply both code updates for Drupal 7 websites and database updates for Drupal 7 and 8 websites. Acquia Support also uses Drush to troubleshoot and scan websites.

Any of the following items must not interfere with running Drush commands (such as drush pm-updatestatus or drush pm-updatecode):

  • custom themes
  • custom modules
  • customizations to the settings.php or sites.php files
  • customizations to contributed modules

Installations of Drupal 8.4.0 or greater requires Drush 9 installation and configuration in the website’s codebase.


Drupal 7 websites built using Composer are not supported by the RA update process.

Drupal 8 core, contributed modules, and distributions are increasingly reliant on Composer to manage dependencies. Although Drush will continue to be used to detect insecure modules, only Composer builds and updates will ensure dependencies are included in any Drupal core or contributed module update.

Installations of Drupal 8.3 or greater require a functional composer.json file located above the docroot directory that includes references to all your website dependencies like Drupal core and contributed modules. Acquia does not recommend modifying the composer.json or vendor/ directory located inside of the docroot directory unless you are removing them. See Acquia Automation: Composer builds for a full explanation of requirements.


Updates using Drush on Drupal 8.3 and greater may still succeed. These builds must not be deployed to production, as Drush does not guarantee completion of dependency updates.

Special considerations for Acquia Cloud Site Factory

During the initial Remote Administration (RA) setup process, Acquia Cloud Site Factory subscribers must provide the RA team with a list of five to ten domain names to be staged during future RA updates. To speed up delivery, the Remote Administration team will stage only the requested websites.

To change the domains staged during RA updates at least two business days before a planned update, contact Acquia Support to provide your list of domain names.

Administrative language

Acquia’s Remote Administration service is currently delivered only in English. For multilingual websites, you must ensure the administrative back end for Drupal is in English. This will improve our efficiency in troubleshooting and updating your website.

Continuous Integration (CI)

Acquia Remote Administration can’t support websites using continuous integration development practices, such as the Acquia Cloud pipelines feature, Jenkins, and Travis, where build artifacts are pushed to the Acquia-hosted Git repository. RA performs repository updates and examines tags for subscriber production code, and these processes aren’t compatible with continuous integration.

Acquia recommends you either ignore or decline automated update branches provided by RA Automation. To receive notifications about available security updates when they’re released, set your RA preferences to Inform only.

Version control system (VCS)

To track changes to your code, Remote Administration requires subscribers to use Git. Remote Administration won’t change code without Git in place. Acquia provides Acquia-hosted subscribers a full repository of their choice.

For recommendations about how to use version control, see Using the recommended workflow.


Acquia Remote Administration does not support updates to websites requiring external Git repositories.

Non-Acquia environments

Acquia doesn’t provide Remote Administration services to subscribers who are not on the Acquia Cloud Platform.