Configuration and Governance of Azure Pipelines Secure Files
Managing sensitive files during deployment requires a strategy that keeps them safe and controls who can use them. In Azure Pipelines, you can use a feature called secure files to store items like certificates, configuration files, or private keys. The best practice is to use Azure Key Vault as the central place for storing and retrieving secrets. This means your pipeline fetches passwords or keys from the Key Vault only when it needs them during a run, instead of having them written directly in the pipeline code where they could be exposed.
Integrating Azure Key Vault
Azure Key Vault is a dedicated service for protecting secrets, keys, and certificates. It uses strong encryption, often with hardware security modules (HSMs), to keep this data safe. By integrating Key Vault with your pipeline, you create a secure boundary. The pipeline has permission to ask the Key Vault for a specific secret, but the secret itself is never stored in the pipeline's configuration. This separation reduces risk and makes it easier to rotate or update secrets without changing your pipeline code.
Enforcing Access Controls
Applying least-privilege permissions is crucial for security. This means giving people and services only the exact permissions they need and nothing more. For pipeline service connections and variable groups, use Azure role-based access control (RBAC) to assign these limited permissions. Avoid using shared account keys for authorization. Instead, use managed identities or Microsoft Entra ID (formerly Azure Active Directory) principals, which provide more secure and traceable access management.
StudyCerts
StudyCerts