# Manage Azure Key Vault with Python

Python teams need reliable patterns for using Azure Key Vault without custom integration code. This skill provides focused examples for secrets, keys, certificates, cryptography, asynchronous access, and error handling.

## Install

```bash
npx skillstore add sickn33/azure-keyvault-py
```

## Metadata

- Status: approved
- Slug: sickn33-azure-keyvault-py
- Skillstore revision: r2
- Version status: missing
- Tree hash: 87d546913c027e393a716c6c5a20eea202505d3f0485d5cfb069a95a97cfa198
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-keyvault-py
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-keyvault-py
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-keyvault-py/manifest

## Capabilities

- Provides package installation commands for Azure secrets, keys, certificates, and identity libraries.
- Configures DefaultAzureCredential and service clients with Azure Key Vault endpoints.
- Demonstrates secret creation, retrieval, listing, deletion, recovery, and permanent purge.
- Shows RSA and EC key creation plus remote encryption, decryption, signing, and verification.
- Covers certificate creation, retrieval, listing, deletion, and authorized private-key retrieval.
- Includes asynchronous secret retrieval and handling for missing resources, denied access, and HTTP errors.

## Use Cases

- Integrate Application Secrets: Add identity-based secret retrieval to a Python service without storing Azure credentials in application code.
- Standardize Vault Operations: Create consistent examples for secret, key, and certificate lifecycle tasks across Azure environments.
- Review Cryptographic Workflows: Evaluate SDK patterns for remote encryption, signing, certificate retrieval, RBAC, and error handling.

## Prompt Templates

### Create a Basic Secret Client

```
Create a Python example that authenticates with DefaultAzureCredential and retrieves a named secret from my Azure Key Vault URL.
```

### Plan a Secret Lifecycle

```
Design a Python workflow to create, list, version, delete, and recover a Key Vault secret with clear error handling.
```

### Use Remote Cryptography

```
Build a Python example that uses a Key Vault RSA key to encrypt, decrypt, sign, and verify data.
```

### Review an Async Integration

```
Review my asynchronous Key Vault integration for RBAC, client cleanup, secret caching, exception handling, and prevention of secret logging.
```

## Limitations

- Requires an Azure subscription, a configured vault, suitable RBAC permissions, and network access.
- Uses placeholder vault names, resource names, versions, and values that require adaptation.
- Does not provision vaults, RBAC roles, managed identities, or automated rotation policies.
- Examples print secret values and require revision before production use.

## Best Practices

- Use managed identity with DefaultAzureCredential for applications hosted on Azure.
- Grant each workload only the required Azure RBAC permissions.
- Keep secret and private-key values out of logs, source control, and persistent caches.

## Anti Patterns

- Do not hardcode production secrets or service principal credentials in Python files.
- Do not purge deleted resources without an approved recovery and retention process.
- Do not cache retrieved secret values longer than the application requires.

## Security Audit

- Audited at: 2026-07-23T20:34:24.785\+00:00
- Summary: All 40 static findings are false positives caused by Markdown syntax, Azure endpoint placeholders, or SDK references. However, two examples print retrieved secret values and could expose credentials through logs.

## Stats

- Views: 101
- Downloads: 8
- Favorites: 0
- Popularity score: 0