Cram Sheet288 words
Topic 4.2 — Managing sensitive information — cram sheet
Topic 4.2 — Managing sensitive information · cram sheet
Key Vault
| Object | Nature |
|---|---|
| Secret | A value the caller retrieves |
| Key | Never leaves the vault — operations happen inside |
| Certificate | X.509 with private key |
"Private key must never be exposed" → use a key, not a secret containing key material. Pipeline access: Key Vault-linked variable group (vault stays the system of record) or the Key Vault task. Authenticate with a managed identity.
Secretless authentication (OIDC / workload identity federation)
- Establish OIDC trust in the cloud provider
- Provider auto-generates a JWT with claims each run
- Workflow presents it as proof of identity
- Cloud returns a short-lived token, valid for that job only
Three documented benefits: no cloud secrets · granular authN/authZ via the cloud provider · automatically rotating credentials. Scope the cloud trust to specific claims (repository, environment) — otherwise any workflow in the org can assume the role.
Sensitive files
- Secure files library — encrypted, outside the repo, and a protected resource (checks + pipeline permissions).
- Never commit a certificate — it stays in git history after rotation.
- On a self-hosted agent the downloaded file persists. Clean it up.
Preventing leakage
| Fact | Detail |
|---|---|
| Log masking | Best-effort. Transformed/encoded secrets are not masked |
| Secret variables in scripts | Must be explicitly mapped via env: |
| Command-line arguments | Avoid — visible in process listings |
| Fork PR validations | Secrets withheld by default — leave it |
| Non-secret variables | Not masked; approvals do not restrict them |
Strongest control: have no secret at all.