Introduction

In this module, you’ll learn how to secure sensitive data—secrets, keys, and certificates—in your DevOps automation pipelines. We’ll focus on best practices for Azure Key Vault, GitHub Actions, and Azure Pipelines so you can confidently manage credentials and cryptographic materials in production environments.

Azure Key Vault

Azure Key Vault is a cloud-hosted service that centralizes the storage and management of secrets, keys, and certificates. You can apply fine-grained access policies, enable detailed logging, and integrate with other Azure services.

Key Vault Components

Quickstart with Azure CLI

# Create a new Key Vault
az keyvault create \
  --name MyVault \
  --resource-group MyResourceGroup \
  --location eastus

# Store a secret
az keyvault secret set \
  --vault-name MyVault \
  --name AppSecret \
  --value s3cr3tValue

# Retrieve the secret
az keyvault secret show \
  --vault-name MyVault \
  --name AppSecret

Access Control, Monitoring, and Best Practices

Secure your vault by defining access policies, enabling logging with Azure Monitor, and rotating keys regularly.

Secrets in CI/CD Pipelines

Managing secrets in your build and release workflows is critical. Below is a quick comparison of GitHub Actions and Azure Pipelines secret stores:

GitHub Actions Example

# .github/workflows/deploy.yml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Use GitHub Secret
        run: echo "API key is ${{ secrets.API_KEY }}"

Azure Pipelines Example

# azure-pipelines.yml
variables:
  - group: KeyVaultVariables

steps:
  - task: AzureKeyVault@1
    inputs:
      azureSubscription: 'MyServiceConnection'
      KeyVaultName: 'MyVault'
      SecretsFilter: '*'
      RunAsPreJob: true
  - script: echo "Fetched secret: $(AppSecret)"

Service Connections in Azure Pipelines

Service connections let your pipelines authenticate to external systems such as Azure, GitHub, or container registries.

Types of Service Connections

Configuring and Using Service Connections

# azure-pipelines.yml
resources:
  connections:
    - connection: MyAzureSubscription
      type: azureResourceManager
    - connection: MyGitHubConnection
      type: github

steps:
  - checkout: self
  - script: |
      az account show
      echo "Cloning via $(MyGitHubConnection)"

Conclusion

By centralizing your secrets in Azure Key Vault, integrating vault access into your CI/CD pipelines, and configuring secure service connections, you’ll build robust, compliant DevOps workflows. Implement these patterns to reduce risk and maintain operational excellence.

Links and References

• Azure Key Vault Documentation
• GitHub Actions Encrypted Secrets
• Azure Pipelines Service Connections