Pass in secrets as environment variables or retrieve at runtime?

Question

I'm wondering what would give me the best result in a test automation framework:

1. CICD build pipeline retrieves secrets and passes them into the test automation framework as environment variables
2. CICD build pipeline passes in keyvault(s) client ID and secret as environment variables and have the framework interface with the vaults to get the secrets it needs

Option 1 seems like the easiest way to go, but doesn't provide as much scalability. Option 2 has more scalability but less security (because we're passing in the KV client as an env variable)

Answer 1

Here is what I did at Microsoft, not saying it's right just what I know. We saved secrets to the Key Vault. For local host we had to install a PEM file and set our environment variable to the SHA of the signature. There was a Setup step that checked if the PEM env var was set to use that to retrieve and set the secrets. That allowed access to the Key Vault. For the build pipeline we could just call the key vault to set the env vars for the secrets.