Azure Key Vault for Python: Comprehensive Secrets, Keys & Certificates Management

Azure Key Vault centralizes secrets, cryptographic keys, and certificates with hardware-backed security, audit logging, and access control. The Python SDK provides Pythonic APIs for all Key Vault operations, eliminating hardcoded credentials and enabling secure configuration management.

What This Skill Does

Provides secret storage and retrieval, cryptographic key operations (encrypt, decrypt, sign, verify), certificate management with auto-renewal, secret versioning and rotation, RBAC and access policies, and async client support for high-performance applications.

Getting Started

pip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity

Store and retrieve secrets:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient(
    vault_url="https://myvault.vault.azure.net",
    credential=credential
)

# Set secret
client.set_secret("database-password", "super-secret-value")

# Get secret
secret = client.get_secret("database-password")
print(secret.value)

Perform cryptographic operations:

from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm

crypto_client = CryptographyClient(key, credential)
encrypted = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep_256, plaintext)
decrypted = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep_256, encrypted.ciphertext)

Key Features

Secret Versioning tracks changes with automatic version management. Hardware Security Modules protect keys in FIPS-validated hardware. Access Policies control who can read/write secrets. Async Support for non-blocking operations. Automatic Rotation eliminates manual secret updates.

When to Use

Use for database connection strings, API keys, OAuth tokens, encryption keys, TLS certificates, and any sensitive configuration. Replace environment variables and config files containing secrets. Essential for production security and compliance.

Source

Maintained by Microsoft. View on GitHub