Implementing a configuration management strategy — quick notes
Configuration strategy — quick notes
| Concept | Detail |
|---|---|
Audit | Report machine state; make no changes |
ApplyAndMonitor | Apply once, then report drift without automatic correction |
ApplyAndAutoCorrect | Correct detected drift at the next evaluation |
| Safe rollout | Audit first; use the findings to choose remediation scope |
| Mutable | Make a scoped update to existing resources |
| Immutable | Redeploy replacements from the latest versioned configuration |
| Pipeline secret retrieval | Key Vault-linked variable group maps names and fetches current values at runtime |
| Application authentication | Managed identity authenticates to Key Vault/Azure without an explicit credential |
Trap: if a secret is committed, revoke or rotate it first; coordinated history cleanup is a separate step.
Sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/01-overview-concepts · https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options · https://learn.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code · https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/workload-supply-chain · https://learn.microsoft.com/en-us/azure/devops/pipelines/security/overview · https://learn.microsoft.com/en-us/azure/devops/pipelines/library/link-variable-groups-to-key-vaults · https://learn.microsoft.com/en-us/azure/key-vault/general/authentication · https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository