CODEWITHSUNDEEP
azure-devopsfirewallazure-keyvaultazure-private-link
P.T
P.T

Reputation: 59

how can i make azure devops as trusted service?

I setup private endpoint for my azure Keyvault and it's working fine and the secrets are accessible through our VPN but the problem is that in our azure pipelines, the build agents are not able to access Keyvault secrets anymore. how can i make it a trusted service? enter image description here

Upvotes: 0

Views: 1709

Answers (2)

Matt Small
Matt Small

Reputation: 2275

You cannot personally add a trusted service. There is a limited set Azure Trusted Services for Key Vault:

https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints#trusted-services

DevOps is specifically called out as a not-trusted service:

The trusted services list does not cover every single Azure service. For example, Azure DevOps is not on the trusted services list. This does not imply that services that do not appear on the trusted services list not trusted or insecure. The trusted services list encompasses services where Microsoft controls all of the code that runs on the service. Since users can write custom code in Azure services such as Azure DevOps, Microsoft does not provide the option to create a blanket approval for the service.

https://learn.microsoft.com/en-us/azure/key-vault/general/network-security

Upvotes: 1

Suki Ji-MSFT
Suki Ji-MSFT

Reputation: 743

If you are using Microsoft hosted agent, you need to grant the hosted agents access through the firewall. Because Azure DevOps uses the Azure global network, IP ranges vary over time. We publish a weekly JSON file listing IP ranges for Azure datacenters, broken out by region. Which means you need to grant access for Microsoft hosted agent weekly. Please refer to Networking for details.

Therefore, self-hosted agent could be a good choice. You could set up a self-hosted agent under the same network. There is the instruction for Self-hosted Windows agents.

Upvotes: 1

Related Questions