Azure Key Vault Secrets for Rust: Type-Safe Secret Management

Hardcoded secrets in source code are a critical security vulnerability. Azure Key Vault eliminates this by centralizing secret storage with hardware-backed security, while Rust's type system ensures secrets are handled safely at compile time.

What This Skill Does

Provides secret storage and retrieval, automatic secret versioning, secret rotation support, soft-delete and purge protection, access control integration, and async/await operations with Tokio.

Getting Started

cargo add azure_security_keyvault_secrets azure_identity

Store and retrieve secrets:

use azure_security_keyvault_secrets::SecretClient;
use azure_identity::DefaultAzureCredential;

let credential = DefaultAzureCredential::new()?;
let client = SecretClient::new(
    "https://myvault.vault.azure.net",
    credential
)?;

// Set secret
client.set_secret("db-password", "secret-value").await?;

// Get secret
let secret = client.get_secret("db-password").await?;
println!("Secret: {}", secret.value);

Key Features

Versioning tracks secret changes automatically. Soft Delete protects against accidental deletion. Type Safety prevents secret mishandling. Hardware Security protects secrets at rest. Async Operations integrate with Tokio for non-blocking I/O.

When to Use

Use for API keys, database passwords, OAuth tokens, encryption keys, and any sensitive configuration. Replace environment variables and hardcoded secrets. Essential for production security.

Source

Maintained by Microsoft. View on GitHub