How to password protect staging environment?

Yes sure, if that is the recommended approach for a staging environment if you use S3 buckets for backups and uploads as well as CloudFront as CDN for uploads and origin on production.

No need to really have all of that for a staging environment?