[![enter image description here][1]][1]Using Azure devops pipelines and want to store my secr[![enter image description here][2]][2]ets in Azure KeyVault? How to use a variable group with keyvault integration to retrieve my secrets values and use within my DevOps pipeline. Below is Yaml script which has hardcoded values of service connection and storage account name,key for to store the terraform tfstate files, my question is how we can pass it as secure type so that no one can see my data. I have created AzureKeyVault and it is linked to provided service connection.
trigger: none
#########################
# Declare Build Agents:-
#########################
pool:
vmImage: ubuntu-latest
######################
#DECLARE PARAMETERS:-
######################
parameters:
- name: ResourceGroup
displayName: Please Provide the Resource Group Name:-
type: object
default: <Please provide the required Name>
- name: Region
displayName: Please Provide the Region Name:-
type: object
default: <Please provide the required Name>
- name: sqlserver
displayName: Please Provide the sqlserver Name:-
type: object
default: <Please provide the required Name>
######################
#DECLARE VARIABLES:-
######################
variables:
TF_VAR_ResourceGroup: ${{ parameters.ResourceGroup }}
TF_VAR_REGION: ${{ parameters.Region }}
TF_VAR_SQLSERVER_NAME: ${{ parameters.sqlserver }}
###################
# Declare Stages:-
###################
stages:
- stage: tfvalidate
jobs:
- job: validate
continueOnError: false
steps:
- task: TerraformInstaller@0
inputs:
terraformVersion: 'latest'
- task: TerraformTaskV3@3
displayName: init
inputs:
provider: 'azurerm'
command: 'init'
backendServiceArm: $(serviceconnection) # it should pick from my azureKeyvault
backendAzureRmResourceGroupName: 'AzureDevops' # it should pick from my azureKeyvault
backendAzureRmStorageAccountName: 'azuredevopsdev' # it should pick from my azureKeyvault
backendAzureRmContainerName: 'tfstatedev' # it should pick from my azureKeyvault
backendAzureRmKey: 'terrafrom.tfstate' # it should pick from my azureKeyvault
- task: TerraformTaskV3@3
displayName: validate
inputs:
provider: 'azurerm'
command: 'validate'
- stage: tfdeploy
condition: succeeded('tfvalidate')
dependsOn: tfvalidate
jobs:
- job: apply
steps:
- task: TerraformInstaller@0
inputs:
terraformVersion: 'latest'
- task: TerraformTaskV3@3
displayName: init
inputs:
provider: 'azurerm'
command: 'init'
backendServiceArm: 'dev-Automationaccount_OIDC'
backendAzureRmResourceGroupName: 'AzureDevops'
backendAzureRmStorageAccountName: 'azuredevopsdev'
backendAzureRmContainerName: 'tfstatedev'
backendAzureRmKey: 'terrafrom.tfstate'
- task: TerraformTaskV3@3
displayName: validate
inputs:
provider: 'azurerm'
command: 'validate'
- task: TerraformTaskV3@3
displayName: plan
inputs:
provider: 'azurerm'
command: 'plan'
environmentServiceNameAzureRM: 'dev-Automationaccount_OIDC'
- task: TerraformTaskV3@3
displayName: apply
inputs:
provider: 'azurerm'
command: 'apply'
commandOptions: '-auto-approve'
environmentServiceNameAzureRM: 'dev-Automationaccount_OIDC'
backendAzureRmContainerName: 'tfstatedev'
backendAzureRmKey: 'terrafrom.tfstate'
- task: TerraformTaskV3@3
displayName: validate
inputs:
provider: 'azurerm'
command: 'validate'
- stage: tfdeploy
condition: succeeded('tfvalidate')
dependsOn: tfvalidate
jobs:
- job: apply
steps:
- task: TerraformInstaller@0
inputs:
terraformVersion: 'latest'
- task: TerraformTaskV3@3
displayName: init
inputs:
provider: 'azurerm'
command: 'init'
backendServiceArm: 'dev-Automationaccount_OIDC'
backendAzureRmResourceGroupName: 'AzureDevops'
backendAzureRmStorageAccountName: 'azuredevopsdev'
backendAzureRmContainerName: 'tfstatedev'
backendAzureRmKey: 'terrafrom.tfstate'
- task: TerraformTaskV3@3
displayName: validate
inputs:
provider: 'azurerm'
command: 'validate'
- task: TerraformTaskV3@3
displayName: plan
inputs:
provider: 'azurerm'
command: 'plan'
environmentServiceNameAzureRM: 'dev-Automationaccount_OIDC'
- task: TerraformTaskV3@3
displayName: apply
inputs:
provider: 'azurerm'
command: 'apply'
commandOptions: '-auto-approve'
environmentServiceNameAzureRM: 'dev-Automationaccount_OIDC'
```
[1]: https://i.stack.imgur.com/W0lU5.png
[2]: https://i.stack.imgur.com/cEm6h.png