Question

Your team maintains an Azure Pipelines YAML pipeline that deploys a web app to production. Database connection strings and API keys are currently stored as plaintext YAML variables committed to the repository. Security requires that these secrets be centrally managed in Azure Key Vault, rotated without editing the pipeline, and referenced by multiple pipelines. Which approach should you implement?

Accepted Answer

Create a variable group linked to the Azure Key Vault, grant the pipeline's service connection access to the vault, and reference the group in each pipeline with the 'group' keyword under variables.

Answer

Store the secrets as secure files in the pipeline library and download them at runtime with the DownloadSecureFile task.

Answer

Encode the secrets as base64 strings and keep them as YAML variables so they are no longer plaintext in the repository.

Answer

Define the secrets as pipeline-level variables marked as secret in the pipeline UI settings for each individual pipeline.