Heim

Skill

Sicherheit

azure-keyvault-py

microsoft/skills

Verwalten Sie Geheimnisse, kryptografische Schlüssel und Zertifikate in Azure Key Vault mit dem Python SDK.

...Alle erweitern

Zeit aktualisiert 12. September 2026

# python # azure key vault # azure sdk # azure identity # certificates # cryptographic keys # secrets

Azure Key Vault SDK für Python

Sichere Speicherung und Verwaltung von Geheimnissen, kryptografischen Schlüsseln und Zertifikaten.

Installation

# Geheimnisse
pip install azure-keyvault-secrets azure-identity

# Schlüssel (kryptografische Operationen)
pip install azure-keyvault-keys azure-identity

# Zertifikate
pip install azure-keyvault-certificates azure-identity

# Alle Pakete
pip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity

Umgebungsvariablen

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/  # Erforderlich für alle Authentifizierungsmethoden
AZURE_TOKEN_CREDENTIALS=prod # Nur erforderlich, wenn DefaultAzureCredential in der Produktion verwendet wird
</vault-name>

Authentifizierung und Lebenszyklus

🔑 Für jedes der folgenden Codebeispiele gelten zwei Regeln:
Bevorzugen Sie DefaultAzureCredential. Es funktioniert lokal (Azure CLI / VS Code / Developer CLI) und in Azure (verwaltete Identität, Workload-Identität) ohne Codeänderung. Vermeiden Sie Verbindungszeichenfolgen, Kontoschlüssel/API-Schlüssel – diese umgehen die Entra-Prüfprotokollierung und Schlüsselrotation.
Lokale Entwicklung: DefaultAzureCredential funktioniert ohne Anpassung.
Produktion: Legen Sie AZURE_TOKEN_CREDENTIALS=prod (oder AZURE_TOKEN_CREDENTIALS=<specific_credential></specific_credential>) fest, um die Anmeldeketten auf produktionssichere Anmeldedaten zu beschränken.
Verpacken Sie jeden Client in einen Kontextmanager, um HTTP-Transportschichten, Sockets und Token-Caches deterministisch freizugeben:
Synchron: with <client>(...) as client:</client>
Asynchron: async with <client>(...) as client:</client> und async with DefaultAzureCredential() as credential: (aus azure.identity.aio)
Codeausschnitte können diese Einrichtung abkürzen, aber Produktionscode sollte stets beide Regeln befolgen.

Geheimnisse

SecretClient-Einrichtung

from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

# Lokale Entwicklung: DefaultAzureCredential. Produktion: AZURE_TOKEN_CREDENTIALS=prod oder AZURE_TOKEN_CREDENTIALS=<specific_credential> festlegen
credential = DefaultAzureCredential(require_envvar=True)
# Oder verwenden Sie direkt eine spezifische Anmeldeinformation in der Produktion:
# Siehe https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with SecretClient(vault_url=vault_url, credential=credential) as client:
    # Alle Geheimnisoperationen erfolgen innerhalb dieses Blocks (siehe Beispiele unten)
    ...
</vault-name></specific_credential>

Geheimnisoperationen

# Geheimnis festlegen
secret = client.set_secret("database-password", "super-secret-value")
print(f"Erstellt: {secret.name}, Version: {secret.properties.version}")

# Geheimnis abrufen
secret = client.get_secret("database-password")
print(f"Wert: {secret.value}")

# Spezifische Version abrufen
secret = client.get_secret("database-password", version="abc123")

# Geheimnisse auflisten (nur Namen, keine Werte)
for secret_properties in client.list_properties_of_secrets():
    print(f"Geheimnis: {secret_properties.name}")

# Versionen auflisten
for version in client.list_properties_of_secret_versions("database-password"):
    print(f"Version: {version.version}, Erstellt: {version.created_on}")

# Geheimnis löschen (weiches Löschen)
poller = client.begin_delete_secret("database-password")
deleted_secret = poller.result()

# Bereinigen (permanentes Löschen, wenn weiches Löschen aktiviert ist)
client.purge_deleted_secret("database-password")

# Gelöschtes Geheimnis wiederherstellen
client.begin_recover_deleted_secret("database-password").result()

Schlüssel

KeyClient-Einrichtung

from azure.identity import DefaultAzureCredential
from azure.keyvault.keys import KeyClient

credential = DefaultAzureCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with KeyClient(vault_url=vault_url, credential=credential) as client:
    # Alle Schlüsseloperationen erfolgen innerhalb dieses Blocks (siehe Beispiele unten)
    ...
</vault-name>

Schlüsseloperationen

from azure.keyvault.keys import KeyType

# RSA-Schlüssel erstellen
rsa_key = client.create_rsa_key("rsa-key", size=2048)

# EC-Schlüssel erstellen
ec_key = client.create_ec_key("ec-key", curve="P-256")

# Schlüssel abrufen
key = client.get_key("rsa-key")
print(f"Schlüsseltyp: {key.key_type}")

# Schlüssel auflisten
for key_properties in client.list_properties_of_keys():
    print(f"Schlüssel: {key_properties.name}")

# Schlüssel löschen
poller = client.begin_delete_key("rsa-key")
deleted_key = poller.result()

Kryptografische Operationen

from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm

# Krypto-Client für einen bestimmten Schlüssel abrufen
# crypto_client = CryptographyClient(key, credential=credential)
# Oder über die Schlüssel-ID
with CryptographyClient(
    "https://<vault>.vault.azure.net/keys/<key-name>/<version>",
    credential=credential
) as crypto_client:
    # Verschlüsseln
    plaintext = b"Hello, Key Vault!"
    result = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)
    ciphertext = result.ciphertext

    # Entschlüsseln
    result = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep, ciphertext)
    decrypted = result.plaintext

    # Signieren
    from azure.keyvault.keys.crypto import SignatureAlgorithm
    import hashlib

    digest = hashlib.sha256(b"data to sign").digest()
    result = crypto_client.sign(SignatureAlgorithm.rs256, digest)
    signature = result.signature

    # Überprüfen
    result = crypto_client.verify(SignatureAlgorithm.rs256, digest, signature)
    print(f"Gültig: {result.is_valid}")
</version></key-name></vault>

Zertifikate

CertificateClient-Einrichtung

from azure.identity import DefaultAzureCredential
from azure.keyvault.certificates import CertificateClient, CertificatePolicy

credential = DefaultAzureCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with CertificateClient(vault_url=vault_url, credential=credential) as client:
    # Alle Zertifikatsoperationen erfolgen innerhalb dieses Blocks (siehe Beispiele unten)
    ...
</vault-name>

Zertifikatsoperationen

# Selbstsigniertes Zertifikat erstellen
policy = CertificatePolicy.get_default()
poller = client.begin_create_certificate("my-cert", policy=policy)
certificate = poller.result()

# Zertifikat abrufen
certificate = client.get_certificate("my-cert")
print(f"Fingerabdruck: {certificate.properties.x509_thumbprint.hex()}")

# Zertifikat mit privatem Schlüssel (als Geheimnis) abrufen
from azure.keyvault.secrets import SecretClient
with SecretClient(vault_url=vault_url, credential=credential) as secret_client:
    cert_secret = secret_client.get_secret("my-cert")
    # cert_secret.value enthält PEM oder PKCS12

# Zertifikate auflisten
for cert in client.list_properties_of_certificates():
    print(f"Zertifikat: {cert.name}")

# Zertifikat löschen
poller = client.begin_delete_certificate("my-cert")
deleted = poller.result()

Tabelle der Clienttypen

Client	Paket	Zweck
`SecretClient`	`azure-keyvault-secrets`	Speichern/Abrufen von Geheimnissen
`KeyClient`	`azure-keyvault-keys`	Verwalten kryptografischer Schlüssel
`CryptographyClient`	`azure-keyvault-keys`	Verschlüsseln/Entschlüsseln/Signieren/Überprüfen
`CertificateClient`	`azure-keyvault-certificates`	Verwalten von Zertifikaten

Asynchrone Clients

from azure.identity.aio import DefaultAzureCredential
from azure.keyvault.secrets.aio import SecretClient

async def get_secret():
    async with DefaultAzureCredential() as credential:
        async with SecretClient(vault_url=vault_url, credential=credential) as client:
            secret = await client.get_secret("my-secret")
            print(secret.value)

import asyncio
asyncio.run(get_secret())

Fehlerbehandlung

from azure.core.exceptions import ResourceNotFoundError, HttpResponseError

try:
    secret = client.get_secret("nonexistent")
except ResourceNotFoundError:
    print("Geheimnis nicht gefunden")
except HttpResponseError as e:
    if e.status_code == 403:
        print("Zugriff verweigert – RBAC-Berechtigungen prüfen")
    raise

Best Practices

Entscheiden Sie sich für synchron ODER asynchron und bleiben Sie konsistent. Mischen Sie keine synchronen azure.xxx-Clients mit asynchronen azure.xxx.aio-Clients im selben Aufrufpfad. Wählen Sie einen Modus pro Modul.
Verwenden Sie stets Kontextmanager für Clients und asynchrone Anmeldedaten. Verpacken Sie jeden Client in with Client(...) as client: (synchron) oder async with Client(...) as client: (asynchron). Für asynchrone DefaultAzureCredential aus azure.identity.aio verwenden Sie ebenfalls async with credential:, um Token und Transportschichten ordnungsgemäß aufzuräumen.
Verwenden Sie DefaultAzureCredential für Code, der lokal ausgeführt wird. Verwenden Sie eine spezifische Tokenanmeldung für Code, der in Azure ausgeführt wird.
Verwenden Sie verwaltete Identitäten in Azure-gehosteten Anwendungen
Aktivieren Sie weiches Löschen zur Wiederherstellung (standardmäßig aktiviert)
Verwenden Sie RBAC anstelle von Zugriffsrichtlinien für feingranulare Steuerung
Rotieren Sie Geheimnisse regelmäßig unter Verwendung der Versionierung
Verwenden Sie Key-Vault-Referenzen in App Service/Functions-Konfigurationen
Cachen Sie Geheimnisse angemessen, um API-Aufrufe zu reduzieren
Verwenden Sie asynchrone Clients für Szenarien mit hohem Durchsatz

Auf GitHub ansehen

---
name: azure-keyvault-py
description: Manage secrets, cryptographic keys, and certificates in Azure Key Vault using the Python SDK.
license: MIT
---

# Azure Key Vault SDK for Python

Secure storage and management for secrets, cryptographic keys, and certificates.

## Installation

```bash
# Secrets
pip install azure-keyvault-secrets azure-identity

# Keys (cryptographic operations)
pip install azure-keyvault-keys azure-identity

# Certificates
pip install azure-keyvault-certificates azure-identity

# All
pip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity
```

## Environment Variables

```bash
AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/  # Required for all auth methods
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in production
```

## Authentication & Lifecycle

> **🔑 Two rules apply to every code sample below:**
>
> 1. **Prefer `DefaultAzureCredential`.** It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
>    - Local dev: `DefaultAzureCredential` works as-is.
>    - Production: set `AZURE_TOKEN_CREDENTIALS=prod` (or `AZURE_TOKEN_CREDENTIALS=<specific_credential>`) to constrain the credential chain to production-safe credentials.
> 2. **Wrap every client in a context manager** so HTTP transports, sockets, and token caches are released deterministically:
>    - Sync: `with <Client>(...) as client:`
>    - Async: `async with <Client>(...) as client:` **and** `async with DefaultAzureCredential() as credential:` (from `azure.identity.aio`)
>
> Snippets may abbreviate this setup, but production code should always follow both rules.

## Secrets

### SecretClient Setup

```python
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential(require_envvar=True)
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with SecretClient(vault_url=vault_url, credential=credential) as client:
    # All secret operations go inside this block (see examples below)
    ...
```

### Secret Operations

```python
# Set secret
secret = client.set_secret("database-password", "super-secret-value")
print(f"Created: {secret.name}, version: {secret.properties.version}")

# Get secret
secret = client.get_secret("database-password")
print(f"Value: {secret.value}")

# Get specific version
secret = client.get_secret("database-password", version="abc123")

# List secrets (names only, not values)
for secret_properties in client.list_properties_of_secrets():
    print(f"Secret: {secret_properties.name}")

# List versions
for version in client.list_properties_of_secret_versions("database-password"):
    print(f"Version: {version.version}, Created: {version.created_on}")

# Delete secret (soft delete)
poller = client.begin_delete_secret("database-password")
deleted_secret = poller.result()

# Purge (permanent delete, if soft-delete enabled)
client.purge_deleted_secret("database-password")

# Recover deleted secret
client.begin_recover_deleted_secret("database-password").result()
```

## Keys

### KeyClient Setup

```python
from azure.identity import DefaultAzureCredential
from azure.keyvault.keys import KeyClient

credential = DefaultAzureCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with KeyClient(vault_url=vault_url, credential=credential) as client:
    # All key operations go inside this block (see examples below)
    ...
```

### Key Operations

```python
from azure.keyvault.keys import KeyType

# Create RSA key
rsa_key = client.create_rsa_key("rsa-key", size=2048)

# Create EC key
ec_key = client.create_ec_key("ec-key", curve="P-256")

# Get key
key = client.get_key("rsa-key")
print(f"Key type: {key.key_type}")

# List keys
for key_properties in client.list_properties_of_keys():
    print(f"Key: {key_properties.name}")

# Delete key
poller = client.begin_delete_key("rsa-key")
deleted_key = poller.result()
```

### Cryptographic Operations

```python
from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm

# Get crypto client for a specific key
# crypto_client = CryptographyClient(key, credential=credential)
# Or from key ID
with CryptographyClient(
    "https://<vault>.vault.azure.net/keys/<key-name>/<version>",
    credential=credential
) as crypto_client:
    # Encrypt
    plaintext = b"Hello, Key Vault!"
    result = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)
    ciphertext = result.ciphertext

    # Decrypt
    result = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep, ciphertext)
    decrypted = result.plaintext

    # Sign
    from azure.keyvault.keys.crypto import SignatureAlgorithm
    import hashlib

    digest = hashlib.sha256(b"data to sign").digest()
    result = crypto_client.sign(SignatureAlgorithm.rs256, digest)
    signature = result.signature

    # Verify
    result = crypto_client.verify(SignatureAlgorithm.rs256, digest, signature)
    print(f"Valid: {result.is_valid}")
```

## Certificates

### CertificateClient Setup

```python
from azure.identity import DefaultAzureCredential
from azure.keyvault.certificates import CertificateClient, CertificatePolicy

credential = DefaultAzureCredential()
vault_url = "https://<vault-name>.vault.azure.net/"

with CertificateClient(vault_url=vault_url, credential=credential) as client:
    # All certificate operations go inside this block (see examples below)
    ...
```

### Certificate Operations

```python
# Create self-signed certificate
policy = CertificatePolicy.get_default()
poller = client.begin_create_certificate("my-cert", policy=policy)
certificate = poller.result()

# Get certificate
certificate = client.get_certificate("my-cert")
print(f"Thumbprint: {certificate.properties.x509_thumbprint.hex()}")

# Get certificate with private key (as secret)
from azure.keyvault.secrets import SecretClient
with SecretClient(vault_url=vault_url, credential=credential) as secret_client:
    cert_secret = secret_client.get_secret("my-cert")
    # cert_secret.value contains PEM or PKCS12

# List certificates
for cert in client.list_properties_of_certificates():
    print(f"Certificate: {cert.name}")

# Delete certificate
poller = client.begin_delete_certificate("my-cert")
deleted = poller.result()
```

## Client Types Table

| Client | Package | Purpose |
|--------|---------|---------|
| `SecretClient` | `azure-keyvault-secrets` | Store/retrieve secrets |
| `KeyClient` | `azure-keyvault-keys` | Manage cryptographic keys |
| `CryptographyClient` | `azure-keyvault-keys` | Encrypt/decrypt/sign/verify |
| `CertificateClient` | `azure-keyvault-certificates` | Manage certificates |

## Async Clients

```python
from azure.identity.aio import DefaultAzureCredential
from azure.keyvault.secrets.aio import SecretClient

async def get_secret():
    async with DefaultAzureCredential() as credential:
        async with SecretClient(vault_url=vault_url, credential=credential) as client:
            secret = await client.get_secret("my-secret")
            print(secret.value)

import asyncio
asyncio.run(get_secret())
```

## Error Handling

```python
from azure.core.exceptions import ResourceNotFoundError, HttpResponseError

try:
    secret = client.get_secret("nonexistent")
except ResourceNotFoundError:
    print("Secret not found")
except HttpResponseError as e:
    if e.status_code == 403:
        print("Access denied - check RBAC permissions")
    raise
```

## Best Practices

1. **Pick sync OR async and stay consistent.** Do not mix `azure.xxx` sync clients with `azure.xxx.aio` async clients in the same call path. Choose one mode per module.
2. **Always use context managers for clients and async credentials.** Wrap every client in `with Client(...) as client:` (sync) or `async with Client(...) as client:` (async). For async `DefaultAzureCredential` from `azure.identity.aio`, also use `async with credential:` so tokens and transports are cleaned up.
3. **Use `DefaultAzureCredential`** for code that runs locally. Use a specific token credential for code that runs in Azure.
4. **Use managed identity** in Azure-hosted applications
5. **Enable soft-delete** for recovery (enabled by default)
6. **Use RBAC** over access policies for fine-grained control
7. **Rotate secrets** regularly using versioning
8. **Use Key Vault references** in App Service/Functions config
9. **Cache secrets** appropriately to reduce API calls
10. **Use async clients** for high-throughput scenarios

Alle Dateien

0 Dateien

azure-keyvault-py installieren

Laden Sie die Skill-Dateien herunter und extrahieren Sie diese in Ihr .claude/skills/-Verzeichnis.

ZIP herunterladen

Klonen Sie das Repository und kopieren Sie die Skill-Dateien in Ihr Projekt.

git clone https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-python/skills/azure-keyvault-py # Copy SKILL.md to your .claude/skills/ directory

Kopieren

Schnelle Einrichtung: Kopieren Sie den Ordner „skill“ nach .claude/skills/. Claude erkennt und verwendet die Fähigkeit automatisch.

Repository microsoft/skills