# Build Azure Key Vault Key Workflows in TypeScript

Azure Key Vault key workflows can be complex and easy to configure incorrectly. This skill provides TypeScript examples for authentication, lifecycle management, cryptography, backup, and rotation.

## Install

```bash
npx skillstore add sickn33/azure-keyvault-keys-ts
```

## Metadata

- Status: approved
- Slug: sickn33-azure-keyvault-keys-ts
- Skillstore revision: r2
- Version status: missing
- Tree hash: 9c8d9640fecb8f1c9c37cf2618d1dcea62ce0d06e6e0145e5a657ee6163c6755
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-keyvault-keys-ts
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-keyvault-keys-ts
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-keyvault-keys-ts/manifest

## Capabilities

- Shows Azure Key Vault authentication with DefaultAzureCredential.
- Demonstrates creating, retrieving, listing, rotating, deleting, and purging keys.
- Covers encryption, decryption, signing, verification, key wrapping, and key unwrapping.
- Provides key rotation policy examples with lifetime actions and expiration periods.
- Demonstrates key and secret backup and restore operations.
- Includes basic Azure SDK error handling for missing secrets.

## Use Cases

- Implement Application Encryption: Create TypeScript services that encrypt and decrypt application data through Azure-managed keys.
- Automate Key Rotation: Define rotation policies, expiration periods, and validation steps for managed Azure keys.
- Review Key Management Controls: Assess key operations, permissions, logging, backup, and destructive actions before production deployment.

## Prompt Templates

### Authenticate to a Vault

```
Show how to authenticate a Node.js TypeScript application to Azure Key Vault with DefaultAzureCredential. Include required packages, environment variables, and error handling.
```

### Create a Managed Key

```
Create a TypeScript example that creates an RSA key named [KEY_NAME] in [VAULT_NAME]. Set expiration, allowed operations, and useful tags.
```

### Design Key Rotation

```
Design a key rotation workflow for [KEY_NAME] with a 90-day lifetime and rotation 30 days before expiry. Explain permissions and validation steps.
```

### Audit a Key Vault Integration

```
Review this TypeScript integration for least privilege, safe logging, retry handling, destructive-operation controls, and cryptographic algorithm choices. Return prioritized findings and tests.
```

## Limitations

- Provides examples and guidance but does not connect to an Azure subscription or execute operations.
- Targets Node.js because the referenced Azure SDK usage does not support browsers.
- Requires an existing vault, valid Azure credentials, and suitable role permissions.
- Examples use placeholders and fixed expiration dates that require production-specific changes.

## Best Practices

- Use DefaultAzureCredential with managed identity and least-privilege Azure roles.
- Set expiration dates and rotation policies for every production key.
- Keep plaintext, secret values, decrypted data, and key material out of logs.

## Anti Patterns

- Do not purge keys or secrets without explicit confirmation and recovery checks.
- Do not grant encrypt, decrypt, sign, or verify permissions unless the application requires them.
- Do not hardcode credentials, secret values, vault-specific identifiers, or production expiration dates.

## Security Audit

- Audited at: 2026-07-23T20:30:01.482\+00:00
- Summary: All 44 static findings are false positives caused by Markdown fences, a TypeScript template literal, normal Azure URLs, and non-secret configuration access. However, the examples expose sensitive values in logs and show irreversible purge operations without confirmation safeguards.

## Stats

- Views: 116
- Downloads: 8
- Favorites: 0
- Popularity score: 0