Seeking the thrill of transformative tech? Explore the art of designing and implementing DevOps solutions on Azure. Master the shift towards CI/CD, testing, and delivery, while preparing for the Designing and Implementing Microsoft DevOps Solutions exam!
Gauge your current knowledge
Gauge your current knowledge
Secret storage is essential for keeping sensitive credentials safe during automated software delivery. Within GitHub Actions, you manage these sensitive variables by navigating to the repository settings, selecting the security options, and adding a new repository secret. For example, a developer might save cloud credentials under a name like AZURE_CREDENTIALS. Once saved, these secrets are encrypted and can be safely referenced inside your workflows without exposing the plain-text values in the source code.
To securely access cloud resources, you can connect your deployment workflows directly to Azure Key Vault. In Azure Pipelines, you pull secret values by utilizing a dedicated Azure Key Vault task, while GitHub Actions can authenticate securely using OpenID Connect (OIDC). This authentication process depends on a federated identity credential created on a Microsoft Entra application, establishing a direct trust boundary between GitHub and Azure. This method allows you to log in by storing only basic structural identifiers, such as the Client ID, Tenant ID, and Subscription ID, as secrets to authenticate the workflow runner.
Securing your deployment pipelines requires limiting access rights to only what is absolutely necessary to complete a task. When configuring service connections, service principals, or managed identities, you must enforce the principle of least privilege. For instance, you should assign minimal roles, such as Reader, rather than broad administrative access. This restriction ensures that the pipeline identity has just enough permission to perform its designated action and cannot modify unrelated cloud resources.
Secrets should not remain active indefinitely, which is why managing their lifecycle is a critical security practice. You can use the built-in capabilities of Azure Key Vault to define specific expiration dates and configure automated rotation policies. Additionally, integrating monitoring and logging features allows you to audit every instance of secret access and modification. This automated system ensures that keys are regularly updated and any unauthorized access attempts are immediately recorded.
StudyCerts
StudyCerts