Azure Learning

pipeline-security-controls

Properties1
tagsaz-400, module, ci, security, pipelines

2 min read

Pipeline security controls

MS Learn module: Pipeline security controls · Learning objectives: apply approval gates and pipeline-security, separate build/test zones to limit explosion radius, run agents on least privilege, and manage secrets in pipelines safely.

Overview

A CI pipeline is an automated path from trusted code to build output. This module is about hardening that path: controlling when risky stages run, containing the blast radius if an agent is compromised, and keeping credentials out of plaintext. Both azure-pipelines and github-actions expose equivalent controls with different names.

Units / lessons covered

  • Approval gates — require a human to authorize a stage (e.g. before secrets cross to another project, or before a release). In Azure Pipelines a manual approval checkpoint pauses the run; in GitHub Actions you model it with required reviewers on the triggering PR.
  • Lateral separation — don’t mix untrusted (user-contributed) and trusted work on the same build host. Separate build, test, and release zones/pools so a compromised agent cannot move sideways into release or prod.
  • Least-privilege agents — run build jobs with the narrowest credential/role needed; agents read source and publish artifacts, nothing more.
  • Secrets in pipelines — never hardcode; use key-vault-backed secret variables (Azure DevOps secret library, GitHub encrypted environment secrets), reference by name in YAML, and limit who can view/edit them.

Key terms / commands

  • Azure Pipelines: secret variables, approval checkpoint, project/prod region separation, scope-limited PATs
  • GitHub Actions: encrypted secrets, actions/checkout + OIDC (azure/login federated identity) instead of long-lived keys

Hands-on / what to try

Add a manual approval checkpoint before a release stage in an Azure Pipelines run; store an API key as a secret variable and reference ${{ secrets.X }} / variables.SECRET in YAML; verify it never appears in plaintext workflow logs.

Exam focus

  • Secret variables are masked in logs and encrypted in the store — never hardcode secrets.
  • Approval gates are the standard answer for controlling risky-to-production stages.
  • Lateral separation / least-privilege agents limits the damage of a compromised build agent.
  • GitHub OIDC / federated identity avoids embedding permanent tokens in workflows (see also branch-protection-and-policies).

Path MOC · pipeline-integration-tests · dependency-and-supply-chain · branch-protection-and-policies

Graph View

Backlinks