Deploy an ARM Template using a DevOps Secure Variable

Problem:

When deploying an ARM template in a DevOps pipeline, you may at some point need to provide a secure string to your deployment. This could be a virtual machine password or some other secret. Ideally you’d reference a Key Vault secret but depending on your security and network requirements, maybe that’s not a viable option.

Solution:

Follow the steps below to setup a secure variable and integrate it into your ARM template deployment:

1. Open your pipeline in DevOps
2. Click the Edit button to edit your pipeline

3. Click on Variables from the top navigation menu

4. Click the Add button

5. Input the name of the variable; i.e. Password

6. Click the lock icon so it appears locked; this makes the variable secure for passwords

7. Add the secure value

8. Click on the Save option under the “Save & Queue” menu

9. Click Save again

10. Click on Tasks from the top navigation menu

11. Click on the “Azure resource group deployment” task to edit the task

12. Click on the ellipsis to the right of the “Override template parameters” input field

13. Next to the VM password variable, input the name of the secure variable surrounded by “$(“ in the front and “)” in the back; i.e. $(Password)

14. Click OK

15. Click on Save & Queue from the “Save & Queue” menu

16. Click on the Save & Queue button in the popup window