{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/azure-keyvault-py",
  "version": "1.0.1",
  "name": "Azure Keyvault Py",
  "description": "Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.\nTriggers: \"key vault\", \"SecretClient\", \"KeyClient\", \"CertificateClient\", \"secrets\", \"encryption keys\".",
  "system_prompt_fragment": "# Azure Key Vault SDK for Python\n\nSecure storage and management for secrets, cryptographic keys, and certificates.\n\n## Installation\n\n```bash\n# Secrets\npip install azure-keyvault-secrets azure-identity\n\n# Keys (cryptographic operations)\npip install azure-keyvault-keys azure-identity\n\n# Certificates\npip install azure-keyvault-certificates azure-identity\n\n# All\npip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity\n```\n\n## Environment Variables\n\n```bash\nAZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/\n```\n\n## Secrets\n\n### SecretClient Setup\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.keyvault.secrets import SecretClient\n\ncredential = DefaultAzureCredential()\nvault_url = \"https://<vault-name>.vault.azure.net/\"\n\nclient = SecretClient(vault_url=vault_url, credential=credential)\n```\n\n### Secret Operations\n\n```python\n# Set secret\nsecret = client.set_secret(\"database-password\", \"super-secret-value\")\nprint(f\"Created: {secret.name}, version: {secret.properties.version}\")\n\n# Get secret\nsecret = client.get_secret(\"database-password\")\nprint(f\"Value: {secret.value}\")\n\n# Get specific version\nsecret = client.get_secret(\"database-password\", version=\"abc123\")\n\n# List secrets (names only, not values)\nfor secret_properties in client.list_properties_of_secrets():\n    print(f\"Secret: {secret_properties.name}\")\n\n# List versions\nfor version in client.list_properties_of_secret_versions(\"database-password\"):\n    print(f\"Version: {version.version}, Created: {version.created_on}\")\n\n# Delete secret (soft delete)\npoller = client.begin_delete_secret(\"database-password\")\ndeleted_secret = poller.result()\n\n# Purge (permanent delete, if soft-delete enabled)\nclient.purge_deleted_secret(\"database-password\")\n\n# Recover deleted secret\nclient.begin_recover_deleted_secret(\"database-password\").result()\n```\n\n## Keys\n\n### KeyClient Setup\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.keyvault.keys import KeyClient\n\ncredential = DefaultAzureCredential()\nvault_url = \"https://<vault-name>.vault.azure.net/\"\n\nclient = KeyClient(vault_url=vault_url, credential=credential)\n```\n\n### Key Operations\n\n```python\nfrom azure.keyvault.keys import KeyType\n\n# Create RSA key\nrsa_key = client.create_rsa_key(\"rsa-key\", size=2048)\n\n# Create EC key\nec_key = client.create_ec_key(\"ec-key\", curve=\"P-256\")\n\n# Get key\nkey = client.get_key(\"rsa-key\")\nprint(f\"Key type: {key.key_type}\")\n\n# List keys\nfor key_properties in client.list_properties_of_keys():\n    print(f\"Key: {key_properties.name}\")\n\n# Delete key\npoller = client.begin_delete_key(\"rsa-key\")\ndeleted_key = poller.result()\n```\n\n### Cryptographic Operations\n\n```python\nfrom azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm\n\n# Get crypto client for a specific key\ncrypto_client = CryptographyClient(key, credential=credential)\n# Or from key ID\ncrypto_client = CryptographyClient(\n    \"https://<vault>.vault.azure.net/keys/<key-name>/<version>\",\n    credential=credential\n)\n\n# Encrypt\nplaintext = b\"Hello, Key Vault!\"\nresult = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)\nciphertext = result.ciphertext\n\n# Decrypt\nresult = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep, ciphertext)\ndecrypted = result.plaintext\n\n# Sign\nfrom azure.keyvault.keys.crypto import SignatureAlgorithm\nimport hashlib\n\ndigest = hashlib.sha256(b\"data to sign\").digest()\nresult = crypto_client.sign(SignatureAlgorithm.rs256, digest)\nsignature = result.signature\n\n# Verify\nresult = crypto_client.verify(SignatureAlgorithm.rs256, digest, signature)\nprint(f\"Valid: {result.is_valid}\")\n```\n\n## Certificates\n\n### CertificateClient Setup\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.keyvault.certificates import CertificateClient, CertificatePolicy\n\ncredential = DefaultAzureCredential()\nvault_url = \"https://<vault-name>.vault.azure.net/\"\n\nclient = CertificateClient(vault_url=vault_url, credential=credential)\n```\n\n### Certificate Operations\n\n```python\n# Create self-signed certificate\npolicy = CertificatePolicy.get_default()\npoller = client.begin_create_certificate(\"my-cert\", policy=policy)\ncertificate = poller.result()\n\n# Get certificate\ncertificate = client.get_certificate(\"my-cert\")\nprint(f\"Thumbprint: {certificate.properties.x509_thumbprint.hex()}\")\n\n# Get certificate with private key (as secret)\nfrom azure.keyvault.secrets import SecretClient\nsecret_client = SecretClient(vault_url=vault_url, credential=credential)\ncert_secret = secret_client.get_secret(\"my-cert\")\n# cert_secret.value contains PEM or PKCS12\n\n# List certificates\nfor cert in client.list_properties_of_certificates():\n    print(f\"Certificate: {cert.name}\")\n\n# Delete certificate\npoller = client.begin_delete_certificate(\"my-cert\")\ndeleted = poller.result()\n```\n\n## Client Types Table\n\n| Client | Package | Purpose |\n|--------|---------|---------|\n| `SecretClient` | `azure-keyvault-secrets` | Store/retrieve secrets |\n| `KeyClient` | `azure-keyvault-keys` | Manage cryptographic keys |\n| `CryptographyClient` | `azure-keyvault-keys` | Encrypt/decrypt/sign/verify |\n| `CertificateClient` | `azure-keyvault-certificates` | Manage certificates |\n\n## Async Clients\n\n```python\nfrom azure.identity.aio import DefaultAzureCredential\nfrom azure.keyvault.secrets.aio import SecretClient\n\nasync def get_secret():\n    credential = DefaultAzureCredential()\n    client = SecretClient(vault_url=vault_url, credential=credential)\n    \n    async with client:\n        secret = await client.get_secret(\"my-secret\")\n        print(secret.value)\n\nimport asyncio\nasyncio.run(get_secret())\n```\n\n## Error Handling\n\n```python\nfrom azure.core.exceptions import ResourceNotFoundError, HttpResponseError\n\ntry:\n    secret = client.get_secret(\"nonexistent\")\nexcept ResourceNotFoundError:\n    print(\"Secret not found\")\nexcept HttpResponseError as e:\n    if e.status_code == 403:\n        print(\"Access denied - check RBAC permissions\")\n    raise\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** for authentication\n2. **Use managed identity** in Azure-hosted applications\n3. **Enable soft-delete** for recovery (enabled by default)\n4. **Use RBAC** over access policies for fine-grained control\n5. **Rotate secrets** regularly using versioning\n6. **Use Key Vault references** in App Service/Functions config\n7. **Cache secrets** appropriately to reduce API calls\n8. **Use async clients** for high-throughput scenarios\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "devops"
  ],
  "category": "devops",
  "invocation": [
    "/azure-keyvault-py"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/azure-keyvault-py",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/azure-keyvault-py",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "devops"
  ],
  "lifecycle": "draft"
}