This document discusses different approaches for managing secrets securely in DevOps deployments. It presents four approaches: 1) using a release orchestrator which allows viewing secrets, 2) using ARM templates which prevents viewing secrets but they must be duplicated, 3) directly accessing key vault which prevents viewing and duplication of secrets but is only available on some Azure services, and 4) directly accessing other services which has the same benefits as 3 but is limited to supported services. The document recommends choosing an approach based on how code and infrastructure are deployed and what capabilities the services support. It also demonstrates config builders for managing secrets locally and in the cloud.

1. SECURE DEPLOYMENTS
KEEPING YOUR
SECRETS PRIVATE
Henry Been
"Locks" (CC BY-NC-ND 2.0) by wolf4max

2. So…
WHO DOES DEVOPS?

3. THE NEED FOR SECRET MANAGEMENT
Develop Build Deploy Operate
Dev Ops
DevOps

4. Access and secret management goals
No team member needs
to hold production secrets
Principle of
least privilege
Decouple authentication
from authorization
Secure storage
of Secrets

6. WONDERING WHO
IS THAT GUY?
HENRY BEEN
Independent Devops & Azure Architect
E: consultancy@henrybeen.nl
T: @henry_been
L: linkedin.com/in/henrybeen
W: henrybeen.nl

7. Approach 1
USING RELEASE ORCHESTRATOR
VSTS
Secrets
Azure Web AppCode

8. Scenario:
• As a team you do CD of your code
• You do not do CD of your infrastructure
USING RELEASE ORCHESTRATOR
VSTS
Secrets
Azure Web AppCode

9. DEMO TIME!
USING RELEASE ORCHESTRATOR

10. USING RELEASE ORCHESTRATOR
• Secrets are pretty secure
• Easy to start with
• Fits existing situations
• You see and copy secrets
• Secrets visible in portal
• Duplication of secrets
• Cannot roll secrets easily
Pros Cons

11. Prerequisite: Have primary & secondary secrets
1. Change the secret in release orchestrator to secondary secret
2. Release
3. Roll primary secret
4. Change the secret in release orchestrator to primary secret
5. Release
6. Roll secondary secret
Intermezzo: Roll a secret

12. Approach 2
USING ARM TEMPLATES
Azure
Web App
Key Vault
VSTSCode & Infra

13. Scenario:
• As a team you do CD of your code
• You also do CD of your infrastructure
USING ARM TEMPLATES
Azure
Web App
Key Vault
VSTSCode & Infra

14. DEMO TIME!
USING ARM TEMPLATES

15. USING ARM TEMPLATES
• No manual copying or
sharing of secrets
• No more manual
duplication of Azure keys
• Secrets visible in portal
• Still cannot roll secrets
easily
Pros Cons

16. Approach 3
DIRECTLY FROM KEY VAULT
VSTS
Azure
Web App
Code & Infra
Key Vault

17. Scenario:
1. You do CD of both infrastructure and code
2. You are allowed to provision to the AD
DIRECTLY ACCESS KEY VAULT
VSTS
Azure
Web App
Code & Infra
Key Vault

18. HOWTO: Local Development
1. Grant your developer account access to (another) Key Vault
• Best alternative
• Requires your machine to be in the same AD domain
2. Only use Key Vault in Azure (locally use Web.config)
• You have to write code to do this (though pretty straightforward)
3. Manually create a development identity and use that
• However… do not check secrets into source control

19. DEMO TIME!
DIRECTLY ACCESS KEY VAULT

20. DIRECTLY ACCESS KEY VAULT
• No manual copying or
sharing of secrets
• No more duplication of
Azure keys
• Secrets no longer visible
in portal
• Changed secrets are
automatically picked up
• Only available on Azure
Web Apps, Azure
Functions and
DataFactory V2
Pros Cons

21. Approach 4
DIRECTLY ACCESS SERVICE
VSTS
Azure
Web App
Code & Infra
AAD
Other Service

22. Scenario:
1. You do CD of both infrastructure and code
2. You are allowed to provision to the AD
3. Service support
DIRECTLY ACCESS SERVICE
VSTS
Azure
Web App
Code & Infra
AAD
Other Service

23. DEMO TIME!
DIRECTLY ACCESS SERVICE

24. DIRECTLY ACCESS SERVICE
• No more secrets • Only available on Azure
Web Apps, Azure Functions
and DataFactory V2
• Only on supported services
Pros Cons

25. Supported services
• Azure Resource Manager
• Azure Key Vault
• Azure Data Lake
• Azure SQL DB
• Azure Event Hubs
• Azure Service Bus
• Azure Storage
https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi

26. "Sloten op de brug" (CC BY-NC-ND 2.0) by Jan Brünemann
RECAP
WHAT TO USE WHEN

27. Use your release orchestrator
Let team operations deploy NEVER EVER EVUHRR
When you deploy only code
Keyvault and ARM templates When you also deploy infra
Application identity / KeyVault When available and allowed
Application identity / Oauth resource When available and allowed
WHAT TO USE WHEN?

28. SECRET MANAGEMNT
USING CONFIG
BUILDERS
FOR LOCAL AND CLOUD
DEVELOPMENT
Requires:
• (.NET Framework ≥ 4.7.1 &&.NET Framework
4.7.1 Development Tools) || ASP.NET Core ≥ 2.0

29. Using .NET Framework

30. "Fail #2" (CC BY-NC-ND 2.0) by zaipe

31. Using .NET Framework

32. RunAs=Developer;
DeveloperTool=VisualStudio

33. Using .NET Core

34. DO TRY THIS AT HOME!
HENRY BEEN
Independent Devops & Azure Architect
E: consultancy@henrybeen.nl
T: @henry_been
L: linkedin.com/in/henrybeen
W: henrybeen.nl