# Build Secure Azure Key Vault Key Workflows

Implementing secure cloud key operations in .NET requires correct SDK, identity, algorithm, and lifecycle choices. This skill provides focused Azure Key Vault patterns and references.

## Install

```bash
npx skillstore add sickn33/azure-security-keyvault-keys-dotnet
```

## Metadata

- Status: approved
- Slug: sickn33-azure-security-keyvault-keys-dotnet
- Skillstore revision: r2
- Version status: missing
- Tree hash: 71e784a1bcccaab16b1dfaa0f1bf52064bd0e7db51357751f1e48b772624deab
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-keys-dotnet
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-security-keyvault-keys-dotnet
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-security-keyvault-keys-dotnet/manifest

## Capabilities

- Explains package installation and KeyClient authentication with DefaultAzureCredential or service-principal placeholders.
- Covers key creation, retrieval, property updates, deletion, recovery, backup, and restore.
- Demonstrates encryption, decryption, key wrapping, signing, verification, and key resolution.
- Shows key rotation and rotation-policy configuration for Azure Key Vault.
- Summarizes supported key types, algorithms, RBAC roles, error handling, and production practices.

## Use Cases

- Start a Key Vault Integration: Configure packages, credentials, vault URIs, and a KeyClient for a new .NET service.
- Design a Key Lifecycle: Plan key creation, rotation, expiration, backup, recovery, and least-privilege operations.
- Review Cryptographic Operations: Compare supported encryption, wrapping, signing, verification, and key-resolution patterns before implementation.

## Prompt Templates

### Create a KeyClient

```
Show how to install Azure Key Vault Keys and Azure Identity, then create a KeyClient with DefaultAzureCredential and placeholder vault settings.
```

### Plan a Key Lifecycle

```
Design a .NET lifecycle for creating, retrieving, updating, rotating, deleting, and recovering an RSA key with least-privilege RBAC.
```

### Implement Cryptographic Operations

```
Create a .NET workflow for RSA-OAEP-256 encryption and RS256 signing, including verification, error handling, and safe logging without plaintext or key exposure.
```

### Review a Production Design

```
Review my Key Vault design for Managed HSM, rotation, version pinning, backup, recovery, caching, RBAC, and destructive-operation safeguards.
```

## Limitations

- Provides reference guidance only and does not execute code, provision Azure resources, or validate a deployment.
- Requires an existing Azure Key Vault or Managed HSM, valid identity, and suitable RBAC permissions.
- Uses placeholders and simplified examples that require environment-specific security review and testing.
- Destructive purge operations need explicit approval, recovery planning, and production safeguards.

## Best Practices

- Prefer managed identity through DefaultAzureCredential and grant only the required Key Vault RBAC role.
- Use HSM-backed keys, expiration dates, restricted operations, automatic rotation, and pinned versions where the risk requires them.
- Review destructive operations, protect backups, handle Azure errors explicitly, and test recovery before production use.

## Anti Patterns

- Do not embed tenant credentials, client secrets, plaintext, or key material in source code or logs.
- Do not enable unnecessary key operations or grant broad management roles to application identities.
- Do not purge keys, restore backups, or change rotation policies without approval and recovery planning.

## Security Audit

- Audited at: 2026-07-23T22:46:06.097\+00:00
- Summary: All 82 static findings are false positives caused by Markdown formatting, expected Azure endpoints, and benign SDK terminology. The file is documentation only and contains no executable scripts, prompt injection, credential exfiltration, or malware behavior.

## Stats

- Views: 136
- Downloads: 10
- Favorites: 0
- Popularity score: 0