What's changed: Deepened AZ-400 Chapter 3 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
3.3Managing IaC, Dependencies, and Secrets
Understand pipeline surroundings—IaC (ARM/Bicep/Terraform), package management (Azure Artifacts), service connections, secrets (Key Vault/variable groups), and agents. Achieve reproducible, secure delivery.
Pipelines also handle infrastructure, dependencies, and secrets. Make environments reproducible with IaC and inject secrets securely.
3.3.1IaC, dependencies, secrets
- IaC: make environments reproducible with ARM/Bicep (Azure-native) / Terraform (multi-cloud).
- Azure Artifacts: centralize dependency packages in feeds (npm/NuGet/Maven/Python; upstream sources).
- Service connections: connect to external resources; prefer workload identity federation to be secretless.
- Secrets: inject securely at runtime from Key Vault or variable groups (secret variables); never log them.
Common on AZ-400: Azure-native IaC = ARM/Bicep, multi-cloud = Terraform, centralized dependencies = Azure Artifacts, external connection = service connection (prefer keyless via identity federation), secret injection = Key Vault/variable groups (secret variables). Never log secrets; prefer keyless (federation/managed identity).
AZ-400 pipeline surroundings probe "reproducible infrastructure, healthy dependencies, secure secrets." IaC codifies environments for reproducibility: choose ARM templates/Bicep (Azure-native, declarative; Bicep is a cleaner DSL over ARM) and Terraform (multi-cloud, state management) by requirement. Apply IaC from the pipeline, previewing diffs with what-if/plan before applying for safety. Centralize dependency packages in Azure Artifacts feeds, proxying/caching upstream sources (npm/NuGet/PyPI/Maven public repos) to unify internal/public behind one endpoint. Service connections authorize access to external resources (Azure subscriptions, registries, Kubernetes); prefer workload identity federation (OIDC) for keyless connections that store no secret (managed identity follows the same idea). Inject secrets at runtime from Azure Key Vault (referenced via Key Vault task/variables) or variable group secret variables, masking logs with issecret=true, never hardcoding. Further protect access to production resources by attaching approvals/checks to service connections and environments. The key is to combine reproducibility via IaC, dependency centralization via Artifacts, and secure secrets via keyless connections and Key Vault.
| Concern | Means | Key point |
|---|---|---|
| Infra reproducibility | ARM/Bicep / Terraform | Azure-native / multi-cloud; preview diffs |
| Dependencies | Azure Artifacts (feeds) | Upstream proxy; unify internal/public |
| External connections | Service connection | Keyless via workload identity federation |
| Secret injection | Key Vault / variable groups | Inject at runtime; mask logs; no hardcoding |
Scenario: Deploy infrastructure from a pipeline to a production Azure subscription, but avoid holding/rotating a service principal secret. → Configure the service connection with workload identity federation (OIDC) to authorize Azure without a secret (keyless). Codify infrastructure in Bicep, applying after reviewing diffs with what-if. Reference app secrets from Key Vault, and protect the production service connection/environment with approval checks.
FAQ: ARM/Bicep or Terraform? To manage only Azure declaratively and adopt new Azure features immediately, use Bicep (Azure-native, cleaner than raw ARM). To span multiple clouds/providers with one tool and state management, use Terraform. Both apply from pipelines; improve safety with pre-apply diff previews (Bicep what-if, Terraform plan).
Exam trap: Storing and reusing a service principal secret in a service connection is undesirable for rotation burden and leak risk—prefer keyless via workload identity federation (OIDC). Also, placing secrets in plaintext in YAML or pipeline variables or logging them is forbidden—inject from Key Vault/secret variables and mask with issecret.
3.3.2Section summary
- Reproducibility = IaC (ARM/Bicep/Terraform) / dependencies = Azure Artifacts
- Connections = service connections (prefer keyless) / secrets = Key Vault/variable groups
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Reference secrets (connection strings/keys) from a pipeline securely without logging. What?
Q2. Centralize shared dependency packages (npm/NuGet) with upstream integration. What?
Q3. Connect a pipeline to Azure resources without storing a service principal secret. Best option?