# Manage Azure Key Vault Keys with Java

Secure key management in Java requires careful Azure SDK configuration and cryptographic choices. This skill provides focused patterns for key lifecycle and cryptographic operations.

## Install

```bash
npx skillstore add sickn33/azure-security-keyvault-keys-java
```

## Metadata

- Status: approved
- Slug: sickn33-azure-security-keyvault-keys-java
- Skillstore revision: r2
- Version status: missing
- Tree hash: a69752a179730f810597913c85ff0a4533dc8ebf08ce56daea236224548bd738
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-keys-java
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network
- Quality score: 69
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-security-keyvault-keys-java
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-security-keyvault-keys-java/manifest

## Capabilities

- Provides synchronous and asynchronous client setup using DefaultAzureCredential.
- Demonstrates creating RSA, elliptic curve, symmetric, and HSM-backed keys.
- Covers key retrieval, updates, listing, deletion, recovery, and permanent purge.
- Shows encryption, decryption, signing, verification, key wrapping, and key unwrapping.
- Explains key backup, restore, import, and automated rotation policies.
- Lists supported encryption and signature algorithms with Java error handling patterns.

## Use Cases

- Integrate a Java Service: Configure a Java application to authenticate and use an existing Key Vault key for cryptographic operations.
- Define Key Lifecycle Controls: Plan creation, rotation, backup, recovery, and deletion workflows for managed keys.
- Review Production Key Usage: Compare HSM options, algorithms, permissions, and operational safeguards before deployment.

## Prompt Templates

### Create a Key Vault Client

```
Create a Java KeyClient using DefaultAzureCredential and vault URL [VAULT_URL]. Explain required dependencies and configuration without embedding credentials.
```

### Implement Key Lifecycle Management

```
Build Java methods to create, retrieve, update, list, rotate, recover, and delete an RSA key named [KEY_NAME]. Exclude permanent purge.
```

### Design a Signing Workflow

```
Design a Java signing and verification flow for [DATA_SOURCE] using Key Vault key [KEY_ID]. Include digest selection, error handling, and tests.
```

### Review a Production Design

```
Review this Java Key Vault design: [DESIGN]. Recommend HSM use, least privilege, rotation, backup protection, logging controls, and safe failure handling.
```

## Limitations

- Provides reference guidance, not an executable project, tests, or deployment automation.
- Requires an Azure identity, a configured vault, network access, and appropriate permissions.
- Uses Azure Key Vault Keys SDK version 4.9.0, so newer SDK behavior may differ.
- Destructive and sensitive operations require environment-specific validation and security review.

## Best Practices

- Use managed identity or another DefaultAzureCredential source instead of embedded credentials.
- Grant only required key permissions and separate administrative duties from application access.
- Protect backup blobs and plaintext, enable recovery controls, and test rotation before production.

## Anti Patterns

- Do not log decrypted plaintext, private key components, backup blobs, or authentication details.
- Do not purge keys automatically or without explicit authorization and recovery validation.
- Do not use one key for unrelated applications, environments, and cryptographic purposes.

## Security Audit

- Audited at: 2026-07-23T22:51:13.8\+00:00
- Summary: All 71 static findings are false positives caused by Markdown backticks, placeholder Azure URLs, Java imports, and a signature-result print statement. The source contains no shell execution, embedded credentials, key files, arbitrary destinations, reconnaissance, or prompt injection. Two contextual issues remain: unprotected local key backup storage and direct logging of decrypted plaintext.

## Stats

- Views: 125
- Downloads: 9
- Favorites: 0
- Popularity score: 0