A YAML pipeline consumes secrets through a variable group that is linked to an Azure key vault named kv-release. The vault uses the vault access policy permission model, and the variable group maps five of the vault's secrets.
Select one answer per row
Linking the variable group copied the five secret values into Azure DevOps when the link was saved.
Linking the variable group copied the five secret values into Azure DevOps when the link was saved.
When one of the five mapped secrets is rotated in kv-release, the next pipeline run fetches the new value without any change to the variable group.
When one of the five mapped secrets is rotated in kv-release, the next pipeline run fetches the new value without any change to the variable group.
A certificate stored in kv-release can be mapped into the variable group the same way as a secret.
A certificate stored in kv-release can be mapped into the variable group the same way as a secret.
The service connection used by the variable group needs at least the Get and List secret permissions on kv-release.
The service connection used by the variable group needs at least the Get and List secret permissions on kv-release.
If kv-release is switched to Azure RBAC and made reachable only through a private endpoint, the variable group link continues to work.
If kv-release is switched to Azure RBAC and made reachable only through a private endpoint, the variable group link continues to work.