Azure Pipeline Download Secure File Location
Astri Gierut
This series of articles outlines recommendations to help you put together a secure YAML-based CI/CD pipeline.It also covers the places where you can make trade-offs between security and flexibility.The series also assumes familiarity with Azure Pipelines, the core Azure DevOps security constructs, and Git.
The contents of the secure files are encrypted and can only be used when you consume them from a task. Secure files are a protected resource. You can add approvals and checks to them and set pipeline permissions. Secure files also can use the Library security model.
Use this task in a pipeline to download a secure file to the agent machine. When specifying the name of the file (using the secureFile input), use the name you specified when uploading it, rather than the actual file name.
Once downloaded, use the name value that is set on the task (or "Reference name" in the classic editor) to reference the path to the secure file on the agent machine. For example, if the task is given the name mySecureFile, its path can be referenced in the pipeline as $(mySecureFile.secureFilePath). Alternatively, downloaded secure files can be found in the directory given by $(Agent.TempDirectory). See a full example below.
It is unnecessary to use this task with the Install Apple Certificate or Install Apple Provisioning Profile tasks because they automatically download, install, and delete (at the end of the pipeline job) the secure file.
Azure will access our GitHub repository to download the code needed to build our project and generate the container image. It will also get the azure-pipelines.yaml file stored in the same repository that contains the tasks that conform the pipeline.
Assuming you already have an Azure DevOps account and created a project, follow the next steps to give Azure Pipelines access to GitHub repositories:
Because data in Key Vaults are sensitive and business critical, you need to secure access to your key vaults by allowing only authorized applications and users. To access the data from the vault, you will need to provide read (Get) permissions to the service principal that you will be using for authentication in the pipeline.
You may want to complete the pipeline definition by specifying the subscription and location for the task. Repeat the same for the last task in the pipeline Azure App Service Deploy. Finally, save and create a new release to start the deployment.
df19127ead