Key Vault for secrets, keys and certificates — quick notes
Key Vault — quick notes
| Object | Nature |
|---|---|
| Secret | Retrievable bytes, up to 25 KB |
| Key | Normal operations do not return asymmetric private material; use a non-exportable key and vault-side operations when material must remain in Key Vault; secure release is an explicit exception |
| Certificate | Certificate plus addressable key/secret; private-key retrieval depends on export policy |
| Pipeline access | Route |
|---|---|
| Linked variable group | Maps selected secret names and fetches current values at runtime; mapping changes are required for added/deleted names |
| AzureKeyVault@2 | Fetches selected/all secrets and sets runtime variables |
| Azure Pipelines authentication | ARM service connection with workload identity federation |
| Suitable Azure compute | Assigned managed identity can obtain a token and call Key Vault directly |
Key idea: non-exportable private material plus vault-side cryptography → use a non-exportable key, not a retrievable secret or exportable certificate.
Sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets · https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-details · https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/link-variable-groups-to-key-vaults?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-key-vault-v2?view=azure-pipelines · https://learn.microsoft.com/en-us/azure/devops/pipelines/release/configure-workload-identity?view=azure-devops · https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview · https://learn.microsoft.com/en-us/azure/key-vault/general/logging