Azure Devops Pipeline Stages: Independent Security

Question

I am attempting to perform Resource Management inside an Azure YAML Pipeline.

The YAML file is checked into source code and can be edited by developers.

Code Reviews will not occur until the deployment is moving from UAT into Production.

I would like to make sure that a deployment to QA cannot perform Resource Management for the resource group associated with the Production Environment. ie: prod databases

---

Can I limit a Service Connection to only be available in certain release stages?
Is there another way to limit Resource Management to specific stages of a pipeline?

Answer 1

Azure Devops Pipeline Stages: Independent Security

I am afraid there is no such way to limit a Service Connection to only be available in certain release stages at this moment.

According to the document we could to know Service connections:

The service connection security is divided into three categories in the service connections new UI:

• User permissions
• Pipeline permissions
• Project permissions

When your pipeline uses the classic UI mode, you could use User permissions to control who can create, view, use and manage the service connection with user permissions.

If your pipeline is YAML mode, you could use the Pipeline permissions, Pipeline permissions control which YAML pipelines are authorized to use this service connection.

So, there is no such way to limit Resource Management to specific stages of a pipeline.

For this request, you could add your request for this feature on our UserVoice site (https://developercommunity.visualstudio.com/content/idea/post.html?space=21 ), which is our main forum for product suggestions. Thank you for helping us build a better Azure DevOps.