Microsoft Certified: DevOps Engineer ExpertDesign and implement pipelinesEasy
A company uses Azure DevOps for its CI/CD pipelines. They have a complex application that requires specific environmental variables and configuration settings for each deployment stage (Dev, Test, Prod). These settings change frequently and contain sensitive information that should not be hardcoded in the pipeline YAML or stored directly in variable groups. Which Azure DevOps feature should the team use to manage these settings securely?
- APipeline Variables
- BVariable Groups
- CAzure Key Vault integration with Variable Groups
- DSecure Files
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Key Vault integration with Variable Groups
Integrating Azure Key Vault with Variable Groups in Azure DevOps allows for securely storing sensitive information like connection strings or API keys in Key Vault and referencing them in pipelines, preventing exposure and enabling centralized management.
Why the other options are wrong
- A. Pipeline Variables are stored directly in the pipeline, which is not secure for sensitive information and makes frequent changes difficult to manage across pipelines.
- B. Variable Groups store variables directly in Azure DevOps and while they can be marked as 'secret', they are not as secure as Key Vault for highly sensitive, frequently changing data, and lack enterprise-grade key management.
- D. Secure Files are used for storing files like certificates or SSH keys, not individual environmental variables or configuration settings.
Azure Key Vault Integration
A feature in Azure DevOps that allows pipelines to securely retrieve secrets, certificates, and keys directly from Azure Key Vault, enhancing security and secret management.
- Centralized secret management.
- Secrets are not stored in pipeline definitions.
- Supports rotation and access policies.
- Integrates with Variable Groups for easy consumption.
Memory trick: Key Vault is the ultimate lock for your pipeline's secrets.