azure-keyvault

Azure Key Vault

Securely store and manage secrets, keys, and certificates in Azure.

When to Use This Skill

Use this skill when:

• Managing secrets, encryption keys, or certificates in Azure
• Implementing centralized secret management for Azure services
• Integrating secrets into AKS, App Service, or Azure Functions
• Encrypting data with customer-managed keys (CMK)
• Meeting compliance requirements for key management (FIPS 140-2)

Prerequisites

• Azure subscription with appropriate permissions
• Azure CLI installed (az command)
• Contributor or Key Vault Administrator role for vault management
• Managed identity configured for application access
• Understanding of Azure RBAC vs. Key Vault access policies

Vault Creation and Configuration

# Create a resource group
az group create --name rg-secrets --location eastus

# Create Key Vault with RBAC authorization (recommended)
az keyvault create \
  --name myapp-vault-prod \
  --resource-group rg-secrets \
  --location eastus \
  --enable-rbac-authorization true \
  --enable-soft-delete true \
  --retention-days 90 \
  --enable-purge-protection true \
  --sku premium  # Use premium for HSM-backed keys

# Create Key Vault with access policies (legacy)
az keyvault create \
  --name myapp-vault-dev \
  --resource-group rg-secrets \
  --location eastus \
  --enable-soft-delete true \
  --retention-days 30

# Enable private endpoint (no public access)
az keyvault update \
  --name myapp-vault-prod \
  --resource-group rg-secrets \
  --public-network-access Disabled

# Enable diagnostics logging
az monitor diagnostic-settings create \
  --name kv-diagnostics \
  --resource "/subscriptions/{sub}/resourceGroups/rg-secrets/providers/Microsoft.KeyVault/vaults/myapp-vault-prod" \
  --workspace "/subscriptions/{sub}/resourceGroups/rg-monitor/providers/Microsoft.OperationalInsights/workspaces/security-logs" \
  --logs '[{"category":"AuditEvent","enabled":true,"retentionPolicy":{"enabled":true,"days":365}}]'