AZ-400 Designing and Implementing Microsoft DevOps Solutions Exam

Implement and Manage Secrets in GitHub Actions and Azure Pipelines

Configure and Integrate Secret Stores

Secret storage plays a critical role in securing DevOps workflows. In Azure, secrets can be managed and integrated using Azure Pipelines and GitHub Actions. This involves tasks such as configuring secrets, managing access, and integrating with secure storage solutions like Azure Key Vault.

Configuring GitHub Actions Secrets

To store secrets in GitHub Actions:

• Open your GitHub repository.
• Navigate to Settings > Security > Secrets and variables > Actions.
• Click New repository secret.
• Enter a name and value for the secret, like AZURE_CREDENTIALS, which you will use in your workflows.

These steps ensure that sensitive data, such as credentials and API keys, are not exposed in your source code. Instead, they remain secure within the GitHub environment, accessible only through the repository’s action workflows.

Integrating with Azure Key Vault

To integrate pipelines with Azure Key Vault:

• Use the Azure Key Vault task in your Azure Pipelines.
• Authenticate with OpenID Connect (OIDC) by creating a federated identity credential on a Microsoft Entra application.
• Store Client ID, Tenant ID, and Subscription ID as secrets in GitHub.

Here is a sample configuration:

- name: Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

By integrating with Azure Key Vault, you can securely retrieve secrets needed during the pipeline execution. This tight integration enhances security and ensures that sensitive information is handled properly during automated processes.

Enforcing Least-Privilege Access

It's essential to enforce least-privilege access for service connections:

• Assign only the necessary roles to service principals or managed identities.
• For example, grant only “Reader” or other minimal roles required for the task.

This minimizes the risk of unauthorized access or actions being performed within your environment. Implementing such practices helps maintain security by ensuring that services and users only have the permissions they need to perform their tasks.

Automating Secret Rotation and Auditing

Automate secret rotation using Key Vault's built-in features:

• Define secret expiry and rotation policies in Key Vault.
• Integrate monitoring and logging to audit secret usage and changes.

Regularly rotating your secrets reduces the risk of these credentials being compromised. By setting up Key Vault policies, you can ensure that secrets are rotated automatically according to your defined schedule. Additionally, auditing tools help monitor and log access to these secrets, providing visibility into who accessed what and when – crucial for security and compliance.

Conclusion

Securing secrets in your DevOps workflows is crucial. In both GitHub Actions and Azure Pipelines, managing these secrets involves storing sensitive information securely, integrating with solutions like Azure Key Vault, enforcing least-privilege access, and automating secret rotation and auditing. By following these practices, DevOps workflows can maintain high security standards, ensuring that sensitive data is always protected.