Security and Azure Devops – part 1

How to configure a project and repository to support secure pipelines?
It can be done in Azure DevOps in an easy way, so read along and configure with me some security best practices for your DevOps environment.

Prerequisites

You must create an Azure DevOps Organization and one project for some exercises, for more info see:

• Create an organization
• Create a project

To get the most out of the exercises I recommend that you have a little understanding of Azure DevOps and pipeline management. If you don’t have the experience, no worries I will cover you and visit the courses below:

• Free online:
  • DevOps Tools
  • Explore Azure Pipelines
  • Integrate with Azure Pipelines

If you are new to Azure and the infrastructure or development world I recommend getting some knowledge about the following topics:

• Azure Fundamentals
• Azure Administrators
• Serverless applications

Setup the environment

Task 1: create a new project in Azure DevOps

1. Navigate to https://dev.azure.com and open your organization (newly created or an existing one).
2. Open the organization settings at the bottom left of the portal and then Projects under the general section.
3. Select the New Project option and use the following settings:
   • name: SecureCodeShop
   • visibility: Private
   • Advanced Version control: Git
   • Advanced Work Item Process: Agile
4. Click on create new project.

Now that the project is created, manage the permissions and settings for each project separately by going to the Project settings menu and selecting the appropriate team project. If you have multiple users or teams working on different projects, you can also assign permissions to each project separately.

Task 2: Create a new repository and set the correct permissions

1. Select the organization name in the upper left corner of the Azure DevOps portal and select the new SecureCodeShop project.
2. Select the Repos menu.
3. Select the Initialize button to initialize the new repository by adding the README.md file.
4. Open the Project settings menu in the lower-left corner of the portal and select Repositories under the Repos section.
5. Select the new eShopSecurity repository and select the Security tab.
6. Remove the Inherit permissions from a parent by unchecking the Inheritance toggle button.
7. Select the Contributors group and select the Deny dropdown for all permissions except Read. This will prevent all users from the Contributors group from accessing the repository.
8. Select your user under Users and select the Allow button to allow all permissions.

9. (Optional) Add a specific group of users, or users that you want to grant access to the repository and run pipelines from the eShopOnWeb project. Click on the search box, enter the name of the group, select it, and then set the permissions you want to allow or deny for the group or user.

Now only the user you assigned permissions and the administrators can access the repository. This is useful when you want to allow specific users to access the repository and run pipelines from the SecureCodeShop project.

Conclusion

Now we have set up a new project in DevOps and set the permissions correctly for the new repository.
We are good to go and in the following blog I explain some yaml files and more options to setup for creating a secure DevOps environment.

Please follow along with the blog series about Secure an Azure DevOps environment and learn by doing!

Thank you and happy coding!