[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6NX2JZ80FFDM8BEX32DDBSZ":3,"skill-same:01M6NX2JZ80FFDM8BEX32DDBSZ":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":28,"commitSha":51,"skillDirectory":52,"forksCount":13,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6NX2JZ80FFDM8BEX32DDBSZ","azure-keyvault",null,"Manage secrets and certificates in Azure Key Vault. Configure access policies, integrate with Azure services, and implement secure secret management. Use when managing secrets in Azure environments.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fazure-keyvault\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"azure","azure keyvault","community","security","relevant","scripts","scope","critical","active","azure key vault","main","secure","only","integrate","configure","access","certificates","secrets","devops-security","assessment","2026-11-10 10:12:30",false,"---\nname: azure-keyvault\ndescription: Manage secrets and certificates in Azure Key Vault. Configure access\n  policies, integrate with Azure services, and implement secure secret management.\n  Use when managing secrets in Azure environments.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Azure Key Vault\n\nSecurely store and manage secrets, keys, and certificates in Azure.\n\n## Prerequisites\n\n- Azure subscription with appropriate permissions\n- Azure CLI installed (`az` command)\n- Contributor or Key Vault Administrator role for vault management\n- Managed identity configured for application access\n- Understanding of Azure RBAC vs. Key Vault access policies\n\n## Vault Creation and Configuration\n\n```bash\n# Create a resource group\naz group create --name rg-secrets --location eastus\n\n# Create Key Vault with RBAC authorization (recommended)\naz keyvault create \\\n  --name myapp-vault-prod \\\n  --resource-group rg-secrets \\\n  --location eastus \\\n  --enable-rbac-authorization true \\\n  --enable-soft-delete true \\\n  --retention-days 90 \\\n  --enable-purge-protection true \\\n  --sku premium  # Use premium for HSM-backed keys\n\n# Create Key Vault with access policies (legacy)\naz keyvault create \\\n  --name myapp-vault-dev \\\n  --resource-group rg-secrets \\\n  --location eastus \\\n  --enable-soft-delete true \\\n  --retention-days 30\n\n# Enable private endpoint (no public access)\naz keyvault update \\\n  --name myapp-vault-prod \\\n  --resource-group rg-secrets \\\n  --public-network-access Disabled\n\n# Enable diagnostics logging\naz monitor diagnostic-settings create \\\n  --name kv-diagnostics \\\n  --resource \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\" \\\n  --workspace \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-monitor\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002Fsecurity-logs\" \\\n  --logs '[{\"category\":\"AuditEvent\",\"enabled\":true,\"retentionPolicy\":{\"enabled\":true,\"days\":365}}]'\n```\n\n## Secret Management\n\n```bash\n# Set a secret\naz keyvault secret set \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --value \"S3cur3P@ssw0rd!\" \\\n  --content-type \"text\u002Fplain\" \\\n  --tags Environment=production Team=platform\n\n# Set a multi-line secret (JSON credentials)\naz keyvault secret set \\\n  --vault-name myapp-vault-prod \\\n  --name db-credentials \\\n  --value '{\"username\":\"dbadmin\",\"password\":\"S3cur3P@ss!\",\"host\":\"db.postgres.database.azure.com\",\"port\":5432}'\n\n# Get secret value\naz keyvault secret show \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --query value -o tsv\n\n# Get specific version\naz keyvault secret show \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --version abc123def456\n\n# List all secrets\naz keyvault secret list --vault-name myapp-vault-prod -o table\n\n# List secret versions\naz keyvault secret list-versions \\\n  --vault-name myapp-vault-prod \\\n  --name db-password -o table\n\n# Set expiration date\naz keyvault secret set-attributes \\\n  --vault-name myapp-vault-prod \\\n  --name api-key \\\n  --expires \"2026-01-01T00:00:00Z\"\n\n# Disable a secret (without deleting)\naz keyvault secret set-attributes \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key \\\n  --enabled false\n\n# Delete a secret (soft-delete)\naz keyvault secret delete \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Recover a deleted secret\naz keyvault secret recover \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Purge a deleted secret (permanent, requires purge protection to be off)\naz keyvault secret purge \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Backup and restore\naz keyvault secret backup \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --file db-password.backup\n\naz keyvault secret restore \\\n  --vault-name myapp-vault-prod \\\n  --file db-password.backup\n```\n\n## Key Management\n\n```bash\n# Create an RSA key for encryption\naz keyvault key create \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --kty RSA \\\n  --size 4096 \\\n  --ops encrypt decrypt wrapKey unwrapKey\n\n# Create an EC key for signing\naz keyvault key create \\\n  --vault-name myapp-vault-prod \\\n  --name signing-key \\\n  --kty EC \\\n  --curve P-256 \\\n  --ops sign verify\n\n# Import an existing key\naz keyvault key import \\\n  --vault-name myapp-vault-prod \\\n  --name imported-key \\\n  --pem-file key.pem\n\n# Encrypt data\naz keyvault key encrypt \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --algorithm RSA-OAEP-256 \\\n  --value \"base64-encoded-plaintext\"\n\n# Rotate a key\naz keyvault key rotate \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key\n\n# Set key rotation policy\naz keyvault key rotation-policy update \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --value '{\n    \"lifetimeActions\": [\n      {\n        \"trigger\": {\"timeBeforeExpiry\": \"P30D\"},\n        \"action\": {\"type\": \"Notify\"}\n      },\n      {\n        \"trigger\": {\"timeAfterCreate\": \"P90D\"},\n        \"action\": {\"type\": \"Rotate\"}\n      }\n    ],\n    \"attributes\": {\"expiryTime\": \"P180D\"}\n  }'\n```\n\n## Certificate Management\n\n```bash\n# Create a self-signed certificate\naz keyvault certificate create \\\n  --vault-name myapp-vault-prod \\\n  --name app-tls-cert \\\n  --policy '{\n    \"issuerParameters\": {\"name\": \"Self\"},\n    \"keyProperties\": {\"exportable\": true, \"keySize\": 4096, \"keyType\": \"RSA\"},\n    \"secretProperties\": {\"contentType\": \"application\u002Fx-pkcs12\"},\n    \"x509CertificateProperties\": {\n      \"subject\": \"CN=app.example.com\",\n      \"subjectAlternativeNames\": {\"dnsNames\": [\"app.example.com\", \"*.app.example.com\"]},\n      \"validityInMonths\": 12,\n      \"keyUsage\": [\"digitalSignature\", \"keyEncipherment\"],\n      \"ekus\": [\"1.3.6.1.5.5.7.3.1\"]\n    },\n    \"lifetimeActions\": [\n      {\"trigger\": {\"daysBeforeExpiry\": 30}, \"action\": {\"actionType\": \"AutoRenew\"}}\n    ]\n  }'\n\n# Import a certificate\naz keyvault certificate import \\\n  --vault-name myapp-vault-prod \\\n  --name imported-cert \\\n  --file certificate.pfx \\\n  --password \"pfx-password\"\n\n# Download certificate\naz keyvault certificate download \\\n  --vault-name myapp-vault-prod \\\n  --name app-tls-cert \\\n  --file cert.pem \\\n  --encoding PEM\n\n# List certificates\naz keyvault certificate list --vault-name myapp-vault-prod -o table\n```\n\n## Access Policies and RBAC\n\n### RBAC (Recommended)\n\n```bash\n# Grant secret reader access to a managed identity\naz role assignment create \\\n  --role \"Key Vault Secrets User\" \\\n  --assignee-object-id \"$(az identity show -g rg-app -n myapp-identity --query principalId -o tsv)\" \\\n  --scope \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\"\n\n# Grant admin access to security team\naz role assignment create \\\n  --role \"Key Vault Administrator\" \\\n  --assignee \"security-team@example.com\" \\\n  --scope \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\"\n\n# Available Key Vault RBAC roles:\n# - Key Vault Administrator (full management)\n# - Key Vault Secrets Officer (manage secrets)\n# - Key Vault Secrets User (read secrets)\n# - Key Vault Certificates Officer (manage certs)\n# - Key Vault Crypto Officer (manage keys)\n# - Key Vault Crypto User (use keys for encrypt\u002Fdecrypt)\n# - Key Vault Reader (read metadata only)\n```\n\n### Access Policies (Legacy)\n\n```bash\n# Grant secret access via access policy\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$(az identity show -g rg-app -n myapp-identity --query principalId -o tsv)\" \\\n  --secret-permissions get list\n\n# Grant key access\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$OBJECT_ID\" \\\n  --key-permissions get unwrapKey wrapKey\n\n# Grant certificate access\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$OBJECT_ID\" \\\n  --certificate-permissions get list\n```\n\n## Application Integration\n\n### Python SDK\n\n```python\nfrom azure.identity import DefaultAzureCredential, ManagedIdentityCredential\nfrom azure.keyvault.secrets import SecretClient\nfrom azure.keyvault.keys import KeyClient\nfrom azure.keyvault.certificates import CertificateClient\n\n# Use DefaultAzureCredential (works locally and in Azure)\ncredential = DefaultAzureCredential()\n\nvault_url = \"https:\u002F\u002Fmyapp-vault-prod.vault.azure.net\u002F\"\n\n# Secrets\nsecret_client = SecretClient(vault_url=vault_url, credential=credential)\ndb_password = secret_client.get_secret(\"db-password\")\nprint(f\"Secret value: {db_password.value}\")\n\n# Get specific version\nspecific = secret_client.get_secret(\"db-password\", version=\"abc123\")\n\n# List secrets\nfor secret_properties in secret_client.list_properties_of_secrets():\n    print(f\"Secret: {secret_properties.name}, Enabled: {secret_properties.enabled}\")\n\n# Keys\nkey_client = KeyClient(vault_url=vault_url, credential=credential)\nfrom azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm\n\nkey = key_client.get_key(\"data-encryption-key\")\ncrypto_client = CryptographyClient(key, credential=credential)\n\n# Encrypt data\nplaintext = b\"sensitive data\"\nresult = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep_256, plaintext)\nciphertext = result.ciphertext\n\n# Decrypt data\ndecrypted = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep_256, ciphertext)\n```\n\n### .NET SDK\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Secrets;\n\nvar credential = new DefaultAzureCredential();\nvar client = new SecretClient(new Uri(\"https:\u002F\u002Fmyapp-vault-prod.vault.azure.net\u002F\"), credential);\n\nKeyVaultSecret secret = await client.GetSecretAsync(\"db-password\");\nstring password = secret.Value;\n```\n\n## Kubernetes Integration (AKS)\n\n### Secrets Store CSI Driver\n\n```yaml\n# SecretProviderClass for AKS with managed identity\napiVersion: secrets-store.csi.x-k8s.io\u002Fv1\nkind: SecretProviderClass\nmetadata:\n  name: azure-keyvault-secrets\n  namespace: production\nspec:\n  provider: azure\n  parameters:\n    usePodIdentity: \"false\"\n    useVMManagedIdentity: \"true\"\n    userAssignedIdentityID: \"\u003Cmanaged-identity-client-id>\"\n    keyvaultName: \"myapp-vault-prod\"\n    cloudName: \"\"\n    objects: |\n      array:\n        - |\n          objectName: db-password\n          objectType: secret\n          objectVersion: \"\"\n        - |\n          objectName: api-key\n          objectType: secret\n        - |\n          objectName: app-tls-cert\n          objectType: secret\n    tenantId: \"\u003Cazure-tenant-id>\"\n  secretObjects:\n    - secretName: db-secrets\n      type: Opaque\n      data:\n        - objectName: db-password\n          key: password\n        - objectName: api-key\n          key: api-key\n    - secretName: tls-secret\n      type: kubernetes.io\u002Ftls\n      data:\n        - objectName: app-tls-cert\n          key: tls.crt\n---\n# Pod using the secrets\napiVersion: v1\nkind: Pod\nmetadata:\n  name: myapp\n  namespace: production\nspec:\n  serviceAccountName: myapp-sa\n  containers:\n    - name: myapp\n      image: ghcr.io\u002Facme\u002Fmyapp:v1.0.0\n      env:\n        - name: DB_PASSWORD\n          valueFrom:\n            secretKeyRef:\n              name: db-secrets\n              key: password\n      volumeMounts:\n        - name: secrets-store\n          mountPath: \"\u002Fmnt\u002Fsecrets-store\"\n          readOnly: true\n  volumes:\n    - name: secrets-store\n      csi:\n        driver: secrets-store.csi.k8s.io\n        readOnly: true\n        volumeAttributes:\n          secretProviderClass: \"azure-keyvault-secrets\"\n```\n\n\n## Contents\n\n- [Terraform Configuration](references\u002Fdetails.md)\n- [Troubleshooting](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n- [Related Skills](references\u002Fdetails.md)\n\n## When to Use This Skill\n\nUse this skill when:\n- Managing secrets, encryption keys, or certificates in Azure\n- Implementing centralized secret management for Azure services\n- Integrating secrets into AKS, App Service, or Azure Functions\n- Encrypting data with customer-managed keys (CMK)\n- Meeting compliance requirements for key management (FIPS 140-2)\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Azure Key Vault\n\nSecurely store and manage secrets, keys, and certificates in Azure.\n\n## Prerequisites\n\n- Azure subscription with appropriate permissions\n- Azure CLI installed (`az` command)\n- Contributor or Key Vault Administrator role for vault management\n- Managed identity configured for application access\n- Understanding of Azure RBAC vs. Key Vault access policies\n\n## Vault Creation and Configuration\n\n```bash\n# Create a resource group\naz group create --name rg-secrets --location eastus\n\n# Create Key Vault with RBAC authorization (recommended)\naz keyvault create \\\n  --name myapp-vault-prod \\\n  --resource-group rg-secrets \\\n  --location eastus \\\n  --enable-rbac-authorization true \\\n  --enable-soft-delete true \\\n  --retention-days 90 \\\n  --enable-purge-protection true \\\n  --sku premium  # Use premium for HSM-backed keys\n\n# Create Key Vault with access policies (legacy)\naz keyvault create \\\n  --name myapp-vault-dev \\\n  --resource-group rg-secrets \\\n  --location eastus \\\n  --enable-soft-delete true \\\n  --retention-days 30\n\n# Enable private endpoint (no public access)\naz keyvault update \\\n  --name myapp-vault-prod \\\n  --resource-group rg-secrets \\\n  --public-network-access Disabled\n\n# Enable diagnostics logging\naz monitor diagnostic-settings create \\\n  --name kv-diagnostics \\\n  --resource \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\" \\\n  --workspace \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-monitor\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002Fsecurity-logs\" \\\n  --logs '[{\"category\":\"AuditEvent\",\"enabled\":true,\"retentionPolicy\":{\"enabled\":true,\"days\":365}}]'\n```\n\n## Secret Management\n\n```bash\n# Set a secret\naz keyvault secret set \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --value \"S3cur3P@ssw0rd!\" \\\n  --content-type \"text\u002Fplain\" \\\n  --tags Environment=production Team=platform\n\n# Set a multi-line secret (JSON credentials)\naz keyvault secret set \\\n  --vault-name myapp-vault-prod \\\n  --name db-credentials \\\n  --value '{\"username\":\"dbadmin\",\"password\":\"S3cur3P@ss!\",\"host\":\"db.postgres.database.azure.com\",\"port\":5432}'\n\n# Get secret value\naz keyvault secret show \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --query value -o tsv\n\n# Get specific version\naz keyvault secret show \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --version abc123def456\n\n# List all secrets\naz keyvault secret list --vault-name myapp-vault-prod -o table\n\n# List secret versions\naz keyvault secret list-versions \\\n  --vault-name myapp-vault-prod \\\n  --name db-password -o table\n\n# Set expiration date\naz keyvault secret set-attributes \\\n  --vault-name myapp-vault-prod \\\n  --name api-key \\\n  --expires \"2026-01-01T00:00:00Z\"\n\n# Disable a secret (without deleting)\naz keyvault secret set-attributes \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key \\\n  --enabled false\n\n# Delete a secret (soft-delete)\naz keyvault secret delete \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Recover a deleted secret\naz keyvault secret recover \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Purge a deleted secret (permanent, requires purge protection to be off)\naz keyvault secret purge \\\n  --vault-name myapp-vault-prod \\\n  --name old-api-key\n\n# Backup and restore\naz keyvault secret backup \\\n  --vault-name myapp-vault-prod \\\n  --name db-password \\\n  --file db-password.backup\n\naz keyvault secret restore \\\n  --vault-name myapp-vault-prod \\\n  --file db-password.backup\n```\n\n## Key Management\n\n```bash\n# Create an RSA key for encryption\naz keyvault key create \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --kty RSA \\\n  --size 4096 \\\n  --ops encrypt decrypt wrapKey unwrapKey\n\n# Create an EC key for signing\naz keyvault key create \\\n  --vault-name myapp-vault-prod \\\n  --name signing-key \\\n  --kty EC \\\n  --curve P-256 \\\n  --ops sign verify\n\n# Import an existing key\naz keyvault key import \\\n  --vault-name myapp-vault-prod \\\n  --name imported-key \\\n  --pem-file key.pem\n\n# Encrypt data\naz keyvault key encrypt \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --algorithm RSA-OAEP-256 \\\n  --value \"base64-encoded-plaintext\"\n\n# Rotate a key\naz keyvault key rotate \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key\n\n# Set key rotation policy\naz keyvault key rotation-policy update \\\n  --vault-name myapp-vault-prod \\\n  --name data-encryption-key \\\n  --value '{\n    \"lifetimeActions\": [\n      {\n        \"trigger\": {\"timeBeforeExpiry\": \"P30D\"},\n        \"action\": {\"type\": \"Notify\"}\n      },\n      {\n        \"trigger\": {\"timeAfterCreate\": \"P90D\"},\n        \"action\": {\"type\": \"Rotate\"}\n      }\n    ],\n    \"attributes\": {\"expiryTime\": \"P180D\"}\n  }'\n```\n\n## Certificate Management\n\n```bash\n# Create a self-signed certificate\naz keyvault certificate create \\\n  --vault-name myapp-vault-prod \\\n  --name app-tls-cert \\\n  --policy '{\n    \"issuerParameters\": {\"name\": \"Self\"},\n    \"keyProperties\": {\"exportable\": true, \"keySize\": 4096, \"keyType\": \"RSA\"},\n    \"secretProperties\": {\"contentType\": \"application\u002Fx-pkcs12\"},\n    \"x509CertificateProperties\": {\n      \"subject\": \"CN=app.example.com\",\n      \"subjectAlternativeNames\": {\"dnsNames\": [\"app.example.com\", \"*.app.example.com\"]},\n      \"validityInMonths\": 12,\n      \"keyUsage\": [\"digitalSignature\", \"keyEncipherment\"],\n      \"ekus\": [\"1.3.6.1.5.5.7.3.1\"]\n    },\n    \"lifetimeActions\": [\n      {\"trigger\": {\"daysBeforeExpiry\": 30}, \"action\": {\"actionType\": \"AutoRenew\"}}\n    ]\n  }'\n\n# Import a certificate\naz keyvault certificate import \\\n  --vault-name myapp-vault-prod \\\n  --name imported-cert \\\n  --file certificate.pfx \\\n  --password \"pfx-password\"\n\n# Download certificate\naz keyvault certificate download \\\n  --vault-name myapp-vault-prod \\\n  --name app-tls-cert \\\n  --file cert.pem \\\n  --encoding PEM\n\n# List certificates\naz keyvault certificate list --vault-name myapp-vault-prod -o table\n```\n\n## Access Policies and RBAC\n\n### RBAC (Recommended)\n\n```bash\n# Grant secret reader access to a managed identity\naz role assignment create \\\n  --role \"Key Vault Secrets User\" \\\n  --assignee-object-id \"$(az identity show -g rg-app -n myapp-identity --query principalId -o tsv)\" \\\n  --scope \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\"\n\n# Grant admin access to security team\naz role assignment create \\\n  --role \"Key Vault Administrator\" \\\n  --assignee \"security-team@example.com\" \\\n  --scope \"\u002Fsubscriptions\u002F{sub}\u002FresourceGroups\u002Frg-secrets\u002Fproviders\u002FMicrosoft.KeyVault\u002Fvaults\u002Fmyapp-vault-prod\"\n\n# Available Key Vault RBAC roles:\n# - Key Vault Administrator (full management)\n# - Key Vault Secrets Officer (manage secrets)\n# - Key Vault Secrets User (read secrets)\n# - Key Vault Certificates Officer (manage certs)\n# - Key Vault Crypto Officer (manage keys)\n# - Key Vault Crypto User (use keys for encrypt\u002Fdecrypt)\n# - Key Vault Reader (read metadata only)\n```\n\n### Access Policies (Legacy)\n\n```bash\n# Grant secret access via access policy\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$(az identity show -g rg-app -n myapp-identity --query principalId -o tsv)\" \\\n  --secret-permissions get list\n\n# Grant key access\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$OBJECT_ID\" \\\n  --key-permissions get unwrapKey wrapKey\n\n# Grant certificate access\naz keyvault set-policy \\\n  --name myapp-vault-prod \\\n  --object-id \"$OBJECT_ID\" \\\n  --certificate-permissions get list\n```\n\n## Application Integration\n\n### Python SDK\n\n```python\nfrom azure.identity import DefaultAzureCredential, ManagedIdentityCredential\nfrom azure.keyvault.secrets import SecretClient\nfrom azure.keyvault.keys import KeyClient\nfrom azure.keyvault.certificates import CertificateClient\n\n# Use DefaultAzureCredential (works locally and in Azure)\ncredential = DefaultAzureCredential()\n\nvault_url = \"https:\u002F\u002Fmyapp-vault-prod.vault.azure.net\u002F\"\n\n# Secrets\nsecret_client = SecretClient(vault_url=vault_url, credential=credential)\ndb_password = secret_client.get_secret(\"db-password\")\nprint(f\"Secret value: {db_password.value}\")\n\n# Get specific version\nspecific = secret_client.get_secret(\"db-password\", version=\"abc123\")\n\n# List secrets\nfor secret_properties in secret_client.list_properties_of_secrets():\n    print(f\"Secret: {secret_properties.name}, Enabled: {secret_properties.enabled}\")\n\n# Keys\nkey_client = KeyClient(vault_url=vault_url, credential=credential)\nfrom azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm\n\nkey = key_client.get_key(\"data-encryption-key\")\ncrypto_client = CryptographyClient(key, credential=credential)\n\n# Encrypt data\nplaintext = b\"sensitive data\"\nresult = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep_256, plaintext)\nciphertext = result.ciphertext\n\n# Decrypt data\ndecrypted = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep_256, ciphertext)\n```\n\n### .NET SDK\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Secrets;\n\nvar credential = new DefaultAzureCredential();\nvar client = new SecretClient(new Uri(\"https:\u002F\u002Fmyapp-vault-prod.vault.azure.net\u002F\"), credential);\n\nKeyVaultSecret secret = await client.GetSecretAsync(\"db-password\");\nstring password = secret.Value;\n```\n\n## Kubernetes Integration (AKS)\n\n### Secrets Store CSI Driver\n\n```yaml\n# SecretProviderClass for AKS with managed identity\napiVersion: secrets-store.csi.x-k8s.io\u002Fv1\nkind: SecretProviderClass\nmetadata:\n  name: azure-keyvault-secrets\n  namespace: production\nspec:\n  provider: azure\n  parameters:\n    usePodIdentity: \"false\"\n    useVMManagedIdentity: \"true\"\n    userAssignedIdentityID: \"\u003Cmanaged-identity-client-id>\"\n    keyvaultName: \"myapp-vault-prod\"\n    cloudName: \"\"\n    objects: |\n      array:\n        - |\n          objectName: db-password\n          objectType: secret\n          objectVersion: \"\"\n        - |\n          objectName: api-key\n          objectType: secret\n        - |\n          objectName: app-tls-cert\n          objectType: secret\n    tenantId: \"\u003Cazure-tenant-id>\"\n  secretObjects:\n    - secretName: db-secrets\n      type: Opaque\n      data:\n        - objectName: db-password\n          key: password\n        - objectName: api-key\n          key: api-key\n    - secretName: tls-secret\n      type: kubernetes.io\u002Ftls\n      data:\n        - objectName: app-tls-cert\n          key: tls.crt\n---\n# Pod using the secrets\napiVersion: v1\nkind: Pod\nmetadata:\n  name: myapp\n  namespace: production\nspec:\n  serviceAccountName: myapp-sa\n  containers:\n    - name: myapp\n      image: ghcr.io\u002Facme\u002Fmyapp:v1.0.0\n      env:\n        - name: DB_PASSWORD\n          valueFrom:\n            secretKeyRef:\n              name: db-secrets\n              key: password\n      volumeMounts:\n        - name: secrets-store\n          mountPath: \"\u002Fmnt\u002Fsecrets-store\"\n          readOnly: true\n  volumes:\n    - name: secrets-store\n      csi:\n        driver: secrets-store.csi.k8s.io\n        readOnly: true\n        volumeAttributes:\n          secretProviderClass: \"azure-keyvault-secrets\"\n```\n\n\n## Contents\n\n- [Terraform Configuration](references\u002Fdetails.md)\n- [Troubleshooting](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n- [Related Skills](references\u002Fdetails.md)\n\n## When to Use This Skill\n\nUse this skill when:\n- Managing secrets, encryption keys, or certificates in Azure\n- Implementing centralized secret management for Azure services\n- Integrating secrets into AKS, App Service, or Azure Functions\n- Encrypting data with customer-managed keys (CMK)\n- Meeting compliance requirements for key management (FIPS 140-2)\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":25,"source":43,"license":14,"category":21,"metadata":44,"date_added":47,"description":7,"source_repo":48,"source_type":20,"compatibility":49,"license_source":50},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":45,"version":46},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fazure-keyvault","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill azure-keyvault",{"tool":62,"command":63},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill azure-keyvault",{"tool":65,"command":66},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill azure-keyvault","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fazure-keyvault\u002FSKILL.md",true,[70],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fdetails.md","REFERENCE","参考文档",3379,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fazure-keyvault\u002Freferences\u002Fdetails.md",[77,96,120,145,173,197],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[89,90,91,92,37,93,79,94,36,33,32,30,20,28,26,25,24,23,22,95],"ZeRO","trust","zero trust","architecture","verification","segmentation","implementing",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[103,104,105,106,107,108,109,110,111,112,113,114,115,30,116,20,117,118,25,119],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[127,128,129,130,131,132,133,134,135,136,137,138,139,20,28,140,141,142,143,144],"transcript","youtube transcript","youtube","safe","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":162,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[151,154,157],{"categoryNo":152,"categoryName":153,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":155,"categoryName":156,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[127,128,129,163,130,164,131,132,134,165,166,167,168,137,169,20,28,170,171,172],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":155,"categoryName":156,"taxonomyType":86,"taxonomyTypeDesc":87},[129,184,185,107,130,186,187,188,189,134,167,190,191,192,193,28,194,140,195,196],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[203],{"categoryNo":152,"categoryName":153,"taxonomyType":86,"taxonomyTypeDesc":87},[205,129,206,207,130,164,165,208,209,166,167,168,137,210,169,20,28,170,211,143],"youtube full","full","google","server","dlp","credits","automatic"]