Azure Learning

best-practice-secrets

Properties2
tagsdevops, security, secrets, cd, best-practice
aliasessecret best practices, secrets hygiene, secure secret handling

2 min read

Best Practices for Secrets

What it is

Best practices for secrets are the proven rules for handling credentials across the software lifecycle: where to store them, what to avoid, and how to reference them so they never end up in source control, logs, or build output. They’re the practical guardrails that make secure continuous deployment actually secure.

Why it exists

The highest-probability security failure in CI/CD is secret leakage: a .env committed, a key printed in a build log, a token pasted into YAML. Because leaked secrets are near-impossible to un-leak, the discipline is prevention — treat every secret as if someone will read your repo and your logs.

Key ideas

  • Never commit secrets to Git or paste them in pipeline YAML/UI definitions → reference them instead.
  • One central store — Azure Key Vault — with RBAC/access policies and audit logging; don’t scatter secrets in custom files.
  • Use secret variables / variable groups linked to Key Vault, fetched at runtime, so rotation doesn’t require a rebuild or a pipeline edit.
  • Never print secrets to logs; Azure DevOps masks secret variable values automatically.
  • Least privilege + separation: distinct credentials per environment/app; revoke what’s not needed.
  • Rotate on schedule and on suspected leak; prefer workload identity federation / managed identities to avoid storing secrets at all.
  • Audit & restrict: who can use a secret, which pipelines/agents can access it (protected, pipeline-scoped access).

How it fits

The best practices are the how behind linked variable groups and Key Vault, and they connect to identity via service connections. Adopt them wholesale for secure CD and for validating pipelines in security/compliance reviews.

Exam notes

  • Core rule to quote: secrets in a store, referenced at runtime, never in source/YAML/logs.
  • Azure DevOps secret variables are masked everywhere and not returned by the API.
  • Key Vault–linked variable group + runtime fetch = rotation-friendly.
  • Prefer federated/managed identities to minimize stored secrets.
  • Separate dev vs prod credentials; least-privilege, audit, rotate.

secrets-management · secure-cd · variables-groups · subscription-connection · environment-approvals

📘 Source: Microsoft Learn — Best Practice Secrets

Graph View

Backlinks