Azure Pipelines secure files

What they are

Azure Pipelines secure files are sensitive files, such as signing certificates, provisioning profiles, keystores, or SSH keys, stored encrypted at rest in an Azure DevOps project’s Library. A pipeline must be explicitly authorized to use a secure file.

Why they exist

A binary credential is not safe to commit to Git or to place in a plain pipeline variable. Secure files give the project a governed delivery mechanism for the file while keeping authorization and audit at the pipeline-resource boundary.

Not the same as

• variables-groups — variable groups hold named values; secure files hold a file artifact.
• key-vault — Key Vault is Azure’s secret/key/certificate service. Use it when the workload can retrieve a secret or certificate at runtime; secure files fit pipeline-only file material.
• service-connection — a service connection authorizes a pipeline to call an external system. It is not a place to store a certificate file.

Lifecycle and failure mode

Upload only the necessary file, restrict its library permissions, authorize only the intended pipeline, use it in a controlled job, and delete it when no longer needed. A secure file cannot be edited or replaced in place: upload a replacement and update authorized pipelines deliberately. A pipeline can fail even with valid YAML when it has not been authorized for the file or its job identity lacks Library permission.

Related

variables-groups · secrets-management · key-vault · pipeline-security · azure-pipelines

Source: Secure files for Azure Pipelines