Implement automated secret rotation for pipeline and application secrets
Implementation Effort: Medium – Automating rotation with Key Vault, runbooks, and workload identity federation is a multi-step effort across platform and security teams. User Impact: Low – Secret rotation runs through Key Vault and deployment pipelines automatically; end users are not affected. Lifecycle Stage: Govern
Overview
Implement automated rotation for pipeline and application secrets so compromised credentials expire quickly and rotated values are picked up automatically by deployment workflows.
Long-lived secrets — API keys, database connection strings, storage account keys, and service credentials — are among the most exploited attack vectors in DevOps environments. When a secret is provisioned once and never rotated, its exposure window is unlimited. A credential leaked through a log file, a misconfigured variable group, or a compromised third-party integration remains valid indefinitely, giving threat actors persistent access that outlasts incident response efforts.
Use Azure Key Vault as the primary rotation system for pipeline and application secrets. Azure Key Vault provides native rotation policies for cryptographic keys and can automate rotation for some resource types, such as storage account keys. For generic secrets, including SQL database passwords, pair Key Vault with an automation runbook, Logic App, or Azure Function that updates the external system credential and then writes the new value back to Key Vault.
For CI/CD pipelines, retrieve secrets from Key Vault at runtime so rotated values are picked up automatically on the next run. Prefer workload identity federation or linked Key Vault integrations instead of storing static copies in GitHub repository secrets, GitHub environment secrets, or Azure Pipelines variable groups.
Platform-specific guidance matters. In GitHub Actions, use workload identity federation plus Key Vault retrieval actions or scripts so workflows authenticate without long-lived Azure client secrets. In Azure Pipelines, use linked Key Vault variable groups where appropriate, or configure Azure Resource Manager connections to avoid stored credentials. Azure DevOps Services and current supported Azure DevOps Server releases support workload identity federation for Azure Resource Manager service connections by using an app registration with federated credentials that trust the Azure DevOps issuer. Alternatively, Azure DevOps can authenticate using a user-assigned managed identity if the agent VM has that identity assigned, but this is direct managed identity authentication, not federated identity from the ADO issuer. Verify your scenario and choose the appropriate pattern.
For secrets managed outside Key Vault — such as GitHub personal access tokens, Azure DevOps PATs, and third-party API keys — establish a rotation cadence enforced through access reviews and automation scripts that call the respective platform APIs. Also integrate rotation events with monitoring. Azure Key Vault emits Event Grid notifications when secrets are rotated or nearing expiry; route these events to Microsoft Sentinel or your SIEM to create alerts for failed rotations, expired secrets, access anomalies during rotation windows, and successful authentication attempts that continue using an old credential after the cutover window.
Automating rotation applies the Assume breach principle: by shortening the lifetime of every secret, a leaked credential's usefulness to a threat actor is bounded rather than indefinite.