Secure Continuous Deployment
What it is
Secure continuous deployment (secure CD) is continuous delivery/deployment run with security and governance baked into every release stage: secrets are centralized, connections are least-privileged, and each environment keeps human/automated checks before production. It’s the “ship often, but safely and accountably” discipline for release pipelines.
Why it exists
Continuous deployment removes the manual checkpoint, but automation without control is a liability — a compromised credential or a secret in a build log is a breach, and auto-releasing everywhere can cascade a bad change. Secure CD reconciles speed (automation) with safety (guards), so releasing frequently doesn’t lower the security bar.
Key ideas
- Run deployments under governed identities: use least-privilege service principals/managed identities, scoped RBAC per environment.
- Centralize secrets in Azure Key Vault and reference them via linked variable groups — no secrets in repo or YAML.
- Per-environment checks & approvals: gate production behind environment approvals and deployment gates.
- Separate identities per environment: don’t let the dev subscription identity also deploy to prod.
- Progressive exposure: combine with canary/rings to limit blast radius and let post-deployment gates verify health.
- Audit & observe: log everything, in case a rollout must be rolled back.
How it fits
Secure CD is the umbrella that secrets-management, variables-groups, dynamic-approval-checks, environment-approvals, service connections, and best-practice-secrets hang under. It answers “how do we automate releases without creating a back door?”
Exam notes
- Secure CD = CI/CD + secrets hygiene + least-privilege + approvals/gates.
- Key Vault for secrets, service connections for Azure access, environment approvals for human control.
- Least-privilege and separation of dev vs prod credentials are core model answers.
- Know the difference: CD automates the release; secure CD governs how that automation is permitted, secured, and checked.
Related
cd · secrets-management · environment-approvals · deployment-gate · subscription-connection · best-practice-secrets
📘 Source: Microsoft Learn — Secure Cd