# Manage Azure Key Vault Secrets with Java

Java applications need secure credential access without embedding secrets in source code. This skill provides Azure Key Vault SDK patterns for secret lifecycle management.

## Install

```bash
npx skillstore add sickn33/azure-security-keyvault-secrets-java
```

## Metadata

- Status: approved
- Slug: sickn33-azure-security-keyvault-secrets-java
- Skillstore revision: r2
- Version status: missing
- Tree hash: 38ba3cfcef5411903daf40595add7066c0e59aeafb72fcc77a77d1848a0e18f0
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-secrets-java
- Ref: f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-azure-security-keyvault-secrets-java
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-azure-security-keyvault-secrets-java/manifest

## Capabilities

- Configure synchronous and asynchronous secret clients with DefaultAzureCredential.
- Create and retrieve secrets with metadata, tags, activation dates, and expiration dates.
- List secrets and versions without retrieving every secret value.
- Update properties, delete, recover, purge, back up, and restore secrets.
- Load named secrets into Java application configuration.
- Handle common Key Vault errors and rotation workflows.

## Use Cases

- Integrate Application Secrets: Add Key Vault retrieval to a Java service while keeping credentials outside source code.
- Standardize Secret Operations: Define consistent workflows for versioning, rotation, deletion, recovery, and backup across services.
- Review Secret Handling: Assess Java Key Vault patterns for least privilege, safe logging, lifecycle controls, and failure recovery.

## Prompt Templates

### Create a Key Vault Client

```
Show how to add the Azure Key Vault Secrets SDK to a Java Maven project. Create a SecretClient with DefaultAzureCredential.
```

### Load Application Secrets

```
Design a Java service that retrieves [secret names] from [vault URL] without logging values. Include error handling and clear configuration boundaries.
```

### Manage a Secret Lifecycle

```
Create a Java workflow for setting metadata, listing versions, deleting, recovering, and purging [secret name]. Explain permissions and irreversible steps.
```

### Design Resilient Rotation

```
Design a resilient rotation workflow for [secret name] with the Azure Key Vault Java SDK. Include validation, rollback, concurrency, auditing, and secret-safe logging.
```

## Limitations

- Requires an existing Azure Key Vault, valid Azure identity, network access, and appropriate permissions.
- Examples require project-specific imports, dependency management, and validation before compilation.
- Does not provision vaults, role assignments, diagnostic settings, or secret rotation infrastructure.
- Some examples print secret values or persist backups and require hardening before production use.

## Best Practices

- Use managed identities or workload identities with least-privilege Key Vault permissions.
- Log secret names and version identifiers only, never secret values or prefixes.
- Create and validate replacement versions before disabling previous versions.

## Anti Patterns

- Do not hardcode real passwords, API keys, connection strings, or vault credentials in source code.
- Do not persist backup blobs without restricted permissions, retention controls, and secure deletion.
- Do not purge deleted secrets until recovery requirements and approvals are confirmed.

## Security Audit

- Audited at: 2026-07-23T22:54:32.35\+00:00
- Summary: All 57 static findings are false positives caused by Markdown syntax, Azure endpoint examples, Java SDK package names, or placeholder text. Semantic review found unsafe secret logging, local backup persistence without protection guidance, and a rotation sequence that can disable the active version before replacement succeeds.

## Stats

- Views: 106
- Downloads: 9
- Favorites: 0
- Popularity score: 0