Azure Learning

secrets-management

Properties2
tagsdevops, security, secrets, cd
aliasessecret management, secret store, Azure Key Vault, managing secrets

2 min read

Secrets Management

What it is

Secrets management is the practice of securely storing, retrieving, rotating, and guarding the non-public values a deployment depends on — passwords, API keys, connection strings, certificates, service principal credentials. In Azure DevOps the canonical secret store is Azure Key Vault, referenced from pipelines via variable groups or service connection linkings.

Why it exists

Secrets are dangerous to version. A secret committed to a Git repo or baked into a pipeline definition is effectively public once anyone with read access touches it. Secrets management centralizes secrets in an audited, encrypted, access-controlled store so pipelines reference a secret instead of embedding one.

Key ideas

  • Never commit secrets to source control or embed them in YAML/definition files — reference them instead.
  • Azure Key Vault is the recommended store: encryption at rest, RBAC/access policies, audit logging, and key/cert/secret vaults.
  • Decouple secret from location: a pipeline uses a secret variable whose value never appears in plaintext logs or pipeline UI.
  • Rotation: rotate secrets on schedule and make deployments resilient to rotation (fetch fresh values per run).
  • Availability: fetch secrets at runtime/deployment time, not bake time, so rotation doesn’t force a rebuild.

How it fits

Secrets management underpins secure continuous deployment: CI/CD pipelines that connect to Azure subscriptions (service connections) or deploy external resources must authenticate, and that authentication routinely depends on stored secrets. Variable groups link pipeline variables to Key Vault secrets.

Exam notes

  • Azure DevOps has a built-in concept of secret variables (values are masked everywhere, never returned by the API).
  • Variable groups linked to Azure Key Vault let you reference Key Vault secrets as variables; the value is fetched at runtime.
  • “Lock secrets in vault, reference in pipelines” — secrets protected by RBAC, revocable on rotation.
  • Avoid “hardcoded = easy to fix later” — rotation requires reference-based auth.

secure-cd · best-practice-secrets · variables-groups · subscription-connection · environment-approvals · azure-pipelines · service-principal

📘 Source: Microsoft Learn — Secrets Management

Graph View

Backlinks