azure-devops - 在 azure devOps 中部署项目期间编辑 sql 文件以保护凭据

Question

我正在使用开源工具为我的仓库雪花部署模式。我已经成功地完成了表格、视图和过程。目前我面临一个问题，我必须以同样的方式部署雪花阶段。但是当您在 sql 文件中定义它时，阶段需要 url 和 azure saas 令牌，如下所示：

CREATE or replace STAGE myStage
URL = 'azure://xxxxxxxxx.blob.core.windows.net/'
CREDENTIALS = ( AZURE_SAS_TOKEN = 'xxxxxxxxxxxxxxxxxxxx' )
file_format = myFileFormat;

因为不鼓励在文件中使用您的凭据，该文件将在版本控制和其他人访问时发布。azure devOps 中是否有方法/任务，所以我可以在 repo 中传递一个模板 SQL 文件并在编译和执行之前更改它（可能是通过 azure key vault）并改回模板？因此，这些凭据和令牌始终保持安全。

标签： azure-devopscontinuous-integrationcontinuous-deploymentsnowflake-cloud-data-platform

Answer 1

For this issue ,you can use credential-less stages to secure your cloud storage without sharing secrets.

Here agree with Mike, storage integrations, a new object type, allow a Snowflake administrator to create a trust policy between Snowflake and the cloud provider. When Snowflake connects to the organization’s cloud storage, the cloud provider authenticates and authorizes access through this trust policy.

Storage integrations and credential-less external stages put into the administrator’s hands the power of connecting to storage in a secure and manageable way. This functionality is now generally available in Snowflake.

For details ,please refer to this document. In addition, you can also via azure key vault, key vault provides a secure place for accessing and storing secrets.