Storing sensitive data securely is critical in any CI/CD pipeline. In this article, we’ll walk through the steps to use Azure Key Vault in Azure Pipelines, from creating a vault to securely retrieving secrets during deployments. By leveraging Azure Key Vault, teams can enhance security and maintain control over sensitive data while automating application deployments.

Setting Up Azure Key Vault

To start using Azure Key Vault, you need to create a vault and add secrets:

1. Create a Key Vault: In the Azure portal, navigate to “Key Vaults” and create a new vault with a unique name and region.
2. Define Access Policies: Set up access policies to allow your Azure DevOps pipeline to read secrets from the vault.
3. Add Secrets: In the vault, go to “Secrets” and add items like API keys, passwords, or connection strings that your application needs.

Step 1: Creating a Service Connection to Key Vault in Azure DevOps

To enable Azure Pipelines to access secrets in Key Vault:

1. Go to Project Settings: In Azure DevOps, navigate to “Project Settings” and select “Service connections.”
2. Add a New Service Connection: Choose “Azure Resource Manager,” select “Service principal (automatic)” or “Service principal (manual),” and connect to the subscription containing your Key Vault.
3. Grant Access to Key Vault: In Key Vault’s access policies, grant this service principal “Get” and “List” permissions for secrets.

Step 2: Referencing Secrets in Azure Pipeline YAML

With the Key Vault service connection in place, you can reference secrets in your pipeline:

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  - group: MyKeyVaultSecrets

steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: 'YourServiceConnection'
      KeyVaultName: 'YourKeyVaultName'
      SecretsFilter: '*'
    displayName: 'Download Secrets from Azure Key Vault'

  - script: echo $(MY_SECRET)
    displayName: 'Use Secret in Pipeline'

This configuration downloads secrets from Key Vault, making them available as environment variables (e.g., $(MY_SECRET)) for use in subsequent tasks.

Step 3: Using Secrets in Application Configurations

Secrets retrieved from Key Vault can be injected into application configuration files or directly into environment variables:

• Environment Variables: Define secrets as environment variables to securely pass them to your application at runtime.
• Configuration Files: Replace placeholder values in configuration files with secrets retrieved from Key Vault.

Example configuration in YAML:

- script: |
    echo "Database connection string: $(DB_CONNECTION_STRING)"
  displayName: 'Inject Secret into Config'

Step 4: Automating Secret Rotation

To enhance security, automate the rotation of secrets regularly:

• Secret Expiration Policies: Set expiration dates for secrets in Key Vault to prompt regular updates.
• Automation Scripts: Use automation scripts or Azure Functions to rotate secrets periodically and update the CI/CD pipeline with new values.
• Audit Logs: Monitor Key Vault access logs to track who accessed secrets and ensure compliance.

Best Practices for Managing Secrets with Azure Key Vault

To optimize the use of Azure Key Vault for secure secret management, follow these best practices:

• Limit Access Permissions: Restrict Key Vault access to only those who need it, following the principle of least privilege.
• Enable Soft-Delete: Use soft-delete to recover deleted secrets if needed, ensuring minimal downtime.
• Monitor Access: Use Azure Monitor and Key Vault’s logging features to track access and detect unauthorized access attempts.
• Use Managed Identities: Enable managed identities to simplify access management and enhance security for Azure resources accessing Key Vault.

Conclusion

Azure Key Vault is an essential tool for managing secrets and sensitive information in Azure Pipelines, allowing secure storage and access to critical data. By integrating Key Vault with your pipeline, you can automate the retrieval of secrets, maintain strict access control, and follow best practices for secure secret management. Leveraging Key Vault in your CI/CD workflow enhances security, reduces risk, and ensures sensitive information remains protected throughout the deployment lifecycle.