AZ400-Q: eliminate a deployment secret
A GitHub Actions workflow deploys to one Azure resource group. It currently stores a service-principal client secret as a repository secret. The security team wants to remove long-lived cloud credentials while preserving least privilege. What should the team implement?
- A) Put the client secret in a different repository secret.
- B) Store the client secret in Key Vault and download it in the workflow.
- C) Give the workflow’s developers Owner at the subscription scope.
- D) Configure OpenID Connect workload identity federation and grant the resulting Azure identity only the required role at the resource-group scope. ✓
Answer: D. OIDC federation exchanges a short-lived workflow identity token for Azure access without retaining a long-lived Azure credential in GitHub. The Azure role assignment remains scoped and least-privilege.
Why not the others: Moving a secret changes storage, not its lifetime. Key Vault remains appropriate for secrets that are necessary, but it does not eliminate this credential. Subscription Owner is excessive.
Related
secretless-pipeline-authentication · service-principal · key-vault