Azure Pipelines - Sharing Service Connections / Credentials across Projects

[@jareksmiejczak5176]

Hey Julie! I'm new to Azure DevOps/Pipelines and your videos guide me through this journey to my first Azure pipeline. Kudos and fist-bumps from Poland, you're a great mentor! ps. 1.4k subscribers? Seriously KZbin? This channel deserves a lot more!

[@JulieNgTech]

You're too kind 🤗 glad it was helpful. Make sure to subscribe and spread the word to help grow the channel beyond 1.4k :) I look forward to your future comments and questions

[@uaena182]

thanks Julie!

[@JulieNgTech]

You are so welcome! Let me know if you have any requests. I really want to help other women in tech in particular :)

[@jona187]

Julie can I share a credential but then limit it to a specific pipeline only?

[@aldodfm]

do you recommend to have a "central project" to manage Service connection for all projects in a ORG ? Gobernance oriented?

[@JulieNgTech]

Depends on what the service connection is. Remember that even if you apply governance controls to it, as soon as an engineer has access to it in the build agent when running a pipeline, they can extract the secrets. That's why code reviews are so important. But the question remains… do you trust all the teams to perform code reviews? What is the blast radius if someone gets those shared credentials? For many large enterprises, the answer to the blast radius question is too large, which is why - if you can manage the overhead (with automation), it's less risky to have many service principals, each scoped with principle of least privilege. Does that answer your question?

[@aldodfm]

@@JulieNgTech Indeed. Thx, Julie! I'm really align with your explanations on your videos.