AZ-400 Question 217
Select 2You are designing an Azure DevOps pipeline to deploy an application to an Azure Kubernetes Service (AKS) cluster. The pipeline must enforce strong security, minimize credential management, and allow only authorized deployments. Which two methods should you use to authenticate and authorize your deployment pipeline with Azure? (Choose two.)
- A
Use an Azure DevOps personal access token (PAT) for authentication and assign the AKS cluster admin role.
- B
Configure a managed identity for your Azure Pipeline and assign it the required Azure RBAC role to the AKS cluster.
- C
Set up a shared SSH key for the AKS nodes and store it in Azure DevOps as a pipeline variable.
- D
Create a service principal in Azure Active Directory and grant it the appropriate Azure RBAC role for resource deployment to AKS.
- E
Manually create local credentials on each AKS node and reference them in the pipeline scripts.
Show answer and explanation
Correct answers: B, D
Explanation
In Azure DevOps, using managed identities or service principals aligns with best practices for authentication and authorization. Managed identities remove the need for credential storage entirely, ensuring that the pipeline can securely acquire tokens for Azure resources without manual secrets. Service principals, when combined with role-based access control (RBAC), provide a granular way to assign only the permissions needed to deploy to AKS. For reference, see Microsoft docs on 'Azure DevOps Service Connections' and 'Managed identities for Azure resources' for secure, automated credential management.
- A. Incorrect.
Option 1: Incorrect. Although personal access tokens can authenticate against Azure DevOps, they are not the standard approach to obtaining permissions for Azure resources like AKS. Relying on a PAT with cluster admin privileges is overly broad and less secure than using a managed identity or service principal with tightly scoped roles.
- B. Correct.
Option 2: Correct. Configuring a managed identity for the pipeline is a best practice to authenticate automatically against Azure resources without requiring manually stored credentials. By assigning the correct Azure RBAC roles to this identity, you can limit what actions the pipeline can perform in AKS.
- C. Incorrect.
Option 3: Incorrect. Using SSH keys for AKS cluster node access does not provide the fine-grained RBAC integration with Azure AD needed for secure deployments. It also introduces additional key management overhead and possible security risks.
- D. Correct.
Option 4: Correct. Creating a service principal allows you to grant precise permissions through Azure RBAC. This is one of the best-supported methods in Azure DevOps for securely deploying resources to AKS without exposing hard-coded credentials in the pipeline.
- E. Incorrect.
Option 5: Incorrect. Manually creating local credentials on each AKS node is not recommended, as it bypasses Azure� built-in identity controls and fine-grained authorization model. It also requires extra manual management, which is error-prone and insecure.