diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index f52a3bad77d..00c58f15013 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -251,6 +251,7 @@ class ProjectPolicy < BasePolicy
     enable :update_pages
     enable :read_cluster
     enable :create_cluster
+    enable :create_environment_terminal
   end
 
   rule { (mirror_available & can?(:admin_project)) | admin }.enable :admin_remote_mirror
diff --git a/app/serializers/environment_entity.rb b/app/serializers/environment_entity.rb
index b18e9706db6..07a13c33b89 100644
--- a/app/serializers/environment_entity.rb
+++ b/app/serializers/environment_entity.rb
@@ -23,9 +23,8 @@ class EnvironmentEntity < Grape::Entity
     stop_project_environment_path(environment.project, environment)
   end
 
-  expose :terminal_path, if: ->(environment, _) { environment.has_terminals? } do |environment|
-    can?(request.current_user, :admin_environment, environment.project) &&
-      terminal_project_environment_path(environment.project, environment)
+  expose :terminal_path, if: ->(*) { environment.has_terminals? && can_access_terminal? } do |environment|
+    terminal_project_environment_path(environment.project, environment)
   end
 
   expose :folder_path do |environment|
@@ -40,7 +39,13 @@ class EnvironmentEntity < Grape::Entity
 
   private
 
+  alias_method :environment, :object
+
   def current_user
     request.current_user
   end
+
+  def can_access_terminal?
+    can?(request.current_user, :create_environment_terminal, environment)
+  end
 end
diff --git a/app/services/ci/enqueue_build_service.rb b/app/services/ci/enqueue_build_service.rb
new file mode 100644
index 00000000000..8140651d980
--- /dev/null
+++ b/app/services/ci/enqueue_build_service.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+module Ci
+  class EnqueueBuildService < BaseService
+    def execute(build)
+      build.enqueue
+    end
+  end
+end
diff --git a/app/services/ci/process_pipeline_service.rb b/app/services/ci/process_pipeline_service.rb
index cda9bbff3b4..cafee76a33c 100644
--- a/app/services/ci/process_pipeline_service.rb
+++ b/app/services/ci/process_pipeline_service.rb
@@ -37,7 +37,7 @@ module Ci
 
     def process_build(build, current_status)
       if valid_statuses_for_when(build.when).include?(current_status)
-        build.action? ? build.actionize : build.enqueue
+        build.action? ? build.actionize : enqueue_build(build)
         true
       else
         build.skip
@@ -93,5 +93,9 @@ module Ci
         .where.not(id: latest_statuses.map(&:first))
         .update_all(retried: true) if latest_statuses.any?
     end
+
+    def enqueue_build(build)
+      Ci::EnqueueBuildService.new(project, @user).execute(build)
+    end
   end
 end
diff --git a/changelogs/unreleased/2747-protected-environments-backend-ce.yml b/changelogs/unreleased/2747-protected-environments-backend-ce.yml
new file mode 100644
index 00000000000..dcec74a33a7
--- /dev/null
+++ b/changelogs/unreleased/2747-protected-environments-backend-ce.yml
@@ -0,0 +1,5 @@
+---
+title: CE Port of Protected Environments backend
+merge_request: 20859
+author:
+type: other
diff --git a/lib/gitlab/import_export/relation_factory.rb b/lib/gitlab/import_export/relation_factory.rb
index 091e81028bb..81807ed659c 100644
--- a/lib/gitlab/import_export/relation_factory.rb
+++ b/lib/gitlab/import_export/relation_factory.rb
@@ -47,7 +47,7 @@ module Gitlab
       end
 
       def initialize(relation_sym:, relation_hash:, members_mapper:, user:, project:, excluded_keys: [])
-        @relation_name = OVERRIDES[relation_sym] || relation_sym
+        @relation_name = self.class.overrides[relation_sym] || relation_sym
         @relation_hash = relation_hash.except('noteable_id')
         @members_mapper = members_mapper
         @user = user
@@ -76,6 +76,10 @@ module Gitlab
         generate_imported_object
       end
 
+      def self.overrides
+        OVERRIDES
+      end
+
       private
 
       def setup_models
diff --git a/spec/services/ci/enqueue_build_service_spec.rb b/spec/services/ci/enqueue_build_service_spec.rb
new file mode 100644
index 00000000000..e41b8e4800b
--- /dev/null
+++ b/spec/services/ci/enqueue_build_service_spec.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+describe Ci::EnqueueBuildService, '#execute' do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+  let(:ci_build) { create(:ci_build, :created) }
+
+  subject { described_class.new(project, user).execute(ci_build) }
+
+  it 'enqueues the build' do
+    subject
+
+    expect(ci_build.pending?).to be_truthy
+  end
+end
diff --git a/spec/support/import_export/configuration_helper.rb b/spec/support/import_export/configuration_helper.rb
index bbac6ca6a9c..b4164cff922 100644
--- a/spec/support/import_export/configuration_helper.rb
+++ b/spec/support/import_export/configuration_helper.rb
@@ -9,7 +9,7 @@ module ConfigurationHelper
   end
 
   def relation_class_for_name(relation_name)
-    relation_name = Gitlab::ImportExport::RelationFactory::OVERRIDES[relation_name.to_sym] || relation_name
+    relation_name = Gitlab::ImportExport::RelationFactory.overrides[relation_name.to_sym] || relation_name
     Gitlab::ImportExport::RelationFactory.relation_class(relation_name)
   end