or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

index.mdkey-management.mdmanaged-hsm.mdoperations.mdprivate-endpoints.mdsecret-management.mdvault-management.md
tile.json

tessl/pypi-azure-mgmt-keyvault

Microsoft Azure Key Vault Management Client Library for Python providing comprehensive programmatic management of Azure Key Vault resources through the Azure Resource Manager API.

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/azure-mgmt-keyvault@12.0.x

To install, run

npx @tessl/cli install tessl/pypi-azure-mgmt-keyvault@12.0.0

index.mddocs/

Azure Key Vault Management Client

Microsoft Azure Key Vault Management Client Library provides comprehensive programmatic management of Azure Key Vault resources through the Azure Resource Manager API. This library enables developers to create, configure, and manage Azure Key Vaults, access policies, keys, secrets, and Managed HSM instances with enterprise-grade security and compliance features.

Package Information

  • Package Name: azure-mgmt-keyvault
  • Language: Python
  • Installation: pip install azure-mgmt-keyvault
  • Requires Python: >=3.9

Core Imports

from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.identity import DefaultAzureCredential

Import models and enums:

from azure.mgmt.keyvault.models import (
    Vault, VaultCreateOrUpdateParameters, VaultProperties,
    AccessPolicyEntry, Permissions, 
    ManagedHsm, Secret, Key
)

Basic Usage

from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.identity import DefaultAzureCredential
from azure.mgmt.keyvault.models import (
    VaultCreateOrUpdateParameters, VaultProperties, Sku, SkuName
)

# Initialize the client
credential = DefaultAzureCredential()
subscription_id = "your-subscription-id"
client = KeyVaultManagementClient(credential, subscription_id)

# Create a new key vault
vault_name = "my-key-vault"
resource_group_name = "my-resource-group"
location = "East US"

vault_properties = VaultProperties(
    tenant_id="your-tenant-id",
    sku=Sku(family="A", name=SkuName.STANDARD),
    access_policies=[]
)

vault_params = VaultCreateOrUpdateParameters(
    location=location,
    properties=vault_properties
)

# Start the vault creation (Long-running operation)
poller = client.vaults.begin_create_or_update(
    resource_group_name, vault_name, vault_params
)
vault = poller.result()
print(f"Created vault: {vault.name}")

# List all vaults in subscription
for vault in client.vaults.list_by_subscription():
    print(f"Vault: {vault.name} in {vault.location}")

# Clean up resources
client.vaults.delete(resource_group_name, vault_name)

Architecture

The Azure Key Vault Management Client follows Azure SDK patterns with a hierarchical structure:

  • KeyVaultManagementClient: Main client providing access to all operation groups
  • Operation Groups: Specialized classes for different resource types (vaults, keys, secrets, managed HSMs)
  • Models: Data classes representing Azure resources and their properties
  • Long-Running Operations (LRO): Asynchronous operations with polling support for resource-intensive tasks
  • Authentication: Integration with Azure Identity for credential management across different authentication flows

The client supports both synchronous and asynchronous patterns, with async versions available in the aio module. All operations follow Azure Resource Manager conventions with consistent parameter patterns and error handling.

Capabilities

Vault Management

Comprehensive Azure Key Vault lifecycle management including creation, configuration, access policy management, and deletion. Supports both basic and premium vault SKUs with advanced security features.

def begin_create_or_update(resource_group_name: str, vault_name: str, parameters: VaultCreateOrUpdateParameters) -> LROPoller[Vault]: ...
def update(resource_group_name: str, vault_name: str, parameters: VaultPatchParameters) -> Vault: ...
def delete(resource_group_name: str, vault_name: str) -> None: ...
def get(resource_group_name: str, vault_name: str) -> Vault: ...
def update_access_policy(resource_group_name: str, vault_name: str, operation_kind: AccessPolicyUpdateKind, parameters: VaultAccessPolicyParameters) -> VaultAccessPolicyParameters: ...
def list_by_resource_group(resource_group_name: str, top: Optional[int] = None) -> ItemPaged[Vault]: ...
def list_by_subscription(top: Optional[int] = None) -> ItemPaged[Vault]: ...
def list_deleted() -> ItemPaged[DeletedVault]: ...
def get_deleted(vault_name: str, location: str) -> DeletedVault: ...
def begin_purge_deleted(vault_name: str, location: str) -> LROPoller[None]: ...
def list(top: Optional[int] = None) -> ItemPaged[Resource]: ...
def check_name_availability(vault_name: VaultCheckNameAvailabilityParameters) -> CheckNameAvailabilityResult: ...

Vault Management

Key Management

Management operations for cryptographic keys within Azure Key Vault, including key creation, versioning, and metadata management through the Azure Resource Manager API.

def create_if_not_exist(resource_group_name: str, vault_name: str, key_name: str, parameters: KeyCreateParameters) -> Key: ...
def get(resource_group_name: str, vault_name: str, key_name: str) -> Key: ...
def list(resource_group_name: str, vault_name: str) -> ItemPaged[Key]: ...
def get_version(resource_group_name: str, vault_name: str, key_name: str, key_version: str) -> Key: ...
def list_versions(resource_group_name: str, vault_name: str, key_name: str) -> ItemPaged[Key]: ...

Key Management

Secret Management

ARM-level operations for managing secrets in Azure Key Vault, primarily intended for ARM template deployments and infrastructure automation rather than runtime secret operations.

def create_or_update(resource_group_name: str, vault_name: str, secret_name: str, parameters: SecretCreateOrUpdateParameters) -> Secret: ...
def update(resource_group_name: str, vault_name: str, secret_name: str, parameters: SecretPatchParameters) -> Secret: ...
def get(resource_group_name: str, vault_name: str, secret_name: str) -> Secret: ...
def list(resource_group_name: str, vault_name: str, top: Optional[int] = None) -> ItemPaged[Secret]: ...

Secret Management

Managed HSM Operations

Complete lifecycle management for Azure Managed Hardware Security Module (HSM) instances, providing dedicated HSM resources with enhanced security and compliance capabilities, including geo-replication region management.

def begin_create_or_update(resource_group_name: str, name: str, parameters: ManagedHsm) -> LROPoller[ManagedHsm]: ...
def begin_update(resource_group_name: str, name: str, parameters: ManagedHsm) -> LROPoller[ManagedHsm]: ...
def begin_delete(resource_group_name: str, name: str) -> LROPoller[None]: ...
def get(resource_group_name: str, name: str) -> Optional[ManagedHsm]: ...
def list_by_resource_group(resource_group_name: str, top: Optional[int] = None) -> ItemPaged[ManagedHsm]: ...
def list_by_subscription(top: Optional[int] = None) -> ItemPaged[ManagedHsm]: ...
def list_by_resource(resource_group_name: str, name: str) -> ItemPaged[MHSMGeoReplicatedRegion]: ...

Managed HSM Operations

Private Endpoint Connections

Management of private endpoint connections for secure network access to Key Vault resources, enabling private connectivity from virtual networks without internet exposure.

def get(resource_group_name: str, vault_name: str, private_endpoint_connection_name: str) -> PrivateEndpointConnection: ...
def put(resource_group_name: str, vault_name: str, private_endpoint_connection_name: str, properties: PrivateEndpointConnection) -> PrivateEndpointConnection: ...
def begin_delete(resource_group_name: str, vault_name: str, private_endpoint_connection_name: str) -> LROPoller[None]: ...
def list_by_resource(resource_group_name: str, vault_name: str) -> ItemPaged[PrivateEndpointConnection]: ...

Private Endpoints

Private Link Resources

Discovery of private link resources supported for Key Vault resources, providing information about available private connectivity options.

def list_by_vault(resource_group_name: str, vault_name: str) -> PrivateLinkResourceListResult: ...

Managed HSM Keys

Management operations for cryptographic keys within Managed HSM instances, providing hardware-backed key operations with FIPS 140-2 Level 3 compliance.

def create_if_not_exist(resource_group_name: str, name: str, key_name: str, parameters: ManagedHsmKeyCreateParameters) -> ManagedHsmKey: ...
def get(resource_group_name: str, name: str, key_name: str) -> ManagedHsmKey: ...
def list(resource_group_name: str, name: str) -> ItemPaged[ManagedHsmKey]: ...
def get_version(resource_group_name: str, name: str, key_name: str, key_version: str) -> ManagedHsmKey: ...
def list_versions(resource_group_name: str, name: str, key_name: str) -> ItemPaged[ManagedHsmKey]: ...

MHSM Private Endpoint Connections

Management of private endpoint connections for Managed HSM instances, enabling secure network access without internet exposure.

def get(resource_group_name: str, name: str, private_endpoint_connection_name: str) -> MHSMPrivateEndpointConnection: ...
def put(resource_group_name: str, name: str, private_endpoint_connection_name: str, properties: MHSMPrivateEndpointConnection) -> MHSMPrivateEndpointConnection: ...
def begin_delete(resource_group_name: str, name: str, private_endpoint_connection_name: str) -> LROPoller[None]: ...
def list_by_resource(resource_group_name: str, name: str) -> ItemPaged[MHSMPrivateEndpointConnection]: ...

MHSM Private Link Resources

Discovery of private link resources supported for Managed HSM instances, providing information about available private connectivity options for HSMs.

def list_by_mhsm_resource(resource_group_name: str, name: str) -> MHSMPrivateLinkResourceListResult: ...

MHSM Regions

Management and discovery of geo-replication regions for Managed HSM instances, providing information about regional availability and replication status.

def list_by_resource(resource_group_name: str, name: str) -> ItemPaged[MHSMGeoReplicatedRegion]: ...

Operations and Resource Discovery

Service discovery and available operations listing for the Azure Key Vault Management API, providing metadata about supported operations and capabilities.

def list() -> ItemPaged[Operation]: ...

Operations

Key Types

Core Client Type

class KeyVaultManagementClient:
    def __init__(
        self, 
        credential: TokenCredential, 
        subscription_id: str, 
        base_url: Optional[str] = None, 
        **kwargs: Any
    ) -> None: ...
    
    def close(self) -> None: ...
    def __enter__(self) -> Self: ...
    def __exit__(self, *exc_details: Any) -> None: ...

Resource Models

class Vault:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    tags: Optional[Dict[str, str]]
    properties: Optional[VaultProperties]
    system_data: Optional[SystemData]

class VaultProperties:
    tenant_id: str
    sku: Sku
    access_policies: Optional[List[AccessPolicyEntry]]
    vault_uri: Optional[str]
    enabled_for_deployment: Optional[bool]
    enabled_for_disk_encryption: Optional[bool] 
    enabled_for_template_deployment: Optional[bool]
    enable_soft_delete: Optional[bool]
    soft_delete_retention_in_days: Optional[int]
    enable_purge_protection: Optional[bool]
    network_acls: Optional[NetworkRuleSet]
    provisioning_state: Optional[VaultProvisioningState]

class ManagedHsm:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    sku: Optional[ManagedHsmSku]
    tags: Optional[Dict[str, str]]
    identity: Optional[ManagedServiceIdentity]
    properties: Optional[ManagedHsmProperties]
    system_data: Optional[SystemData]

Authentication and Configuration

class AccessPolicyEntry:
    tenant_id: str
    object_id: str
    application_id: Optional[str]
    permissions: Permissions

class Permissions:
    keys: Optional[List[KeyPermissions]]
    secrets: Optional[List[SecretPermissions]]
    certificates: Optional[List[CertificatePermissions]]
    storage: Optional[List[StoragePermissions]]

class Sku:
    family: SkuFamily
    name: SkuName

Additional Resource Types

class DeletedVault:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    properties: Optional[DeletedVaultProperties]

class DeletedVaultProperties:
    vault_id: Optional[str]
    location: Optional[str]
    deletion_date: Optional[datetime]
    scheduled_purge_date: Optional[datetime]
    tags: Optional[Dict[str, str]]

class Resource:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    tags: Optional[Dict[str, str]]

class VaultCheckNameAvailabilityParameters:
    name: str
    type: str

class CheckNameAvailabilityResult:
    name_available: Optional[bool]
    reason: Optional[str]
    message: Optional[str]

Key and Secret Management Types

class Key:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    tags: Optional[Dict[str, str]]
    properties: Optional[KeyProperties]

class KeyCreateParameters:
    properties: KeyProperties

class KeyProperties:
    attributes: Optional[KeyAttributes]
    kty: Optional[str]
    key_ops: Optional[List[str]]
    key_size: Optional[int]
    curve: Optional[str]

class Secret:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    tags: Optional[Dict[str, str]]
    properties: Optional[SecretProperties]

class SecretCreateOrUpdateParameters:
    properties: SecretProperties

class SecretPatchParameters:
    properties: Optional[SecretProperties]

class SecretProperties:
    value: Optional[str]
    content_type: Optional[str]
    attributes: Optional[SecretAttributes]

Managed HSM Types

class ManagedHsmKey:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    location: Optional[str]
    tags: Optional[Dict[str, str]]
    properties: Optional[ManagedHsmKeyProperties]

class ManagedHsmKeyCreateParameters:
    properties: ManagedHsmKeyProperties

class ManagedHsmKeyProperties:
    attributes: Optional[ManagedHsmKeyAttributes]
    kty: Optional[str]
    key_ops: Optional[List[str]]
    key_size: Optional[int]
    curve: Optional[str]
    key_uri: Optional[str]
    key_uri_with_version: Optional[str]

Private Connectivity Types

class PrivateEndpointConnection:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    etag: Optional[str]
    properties: Optional[PrivateEndpointConnectionProperties]

class PrivateLinkResourceListResult:
    value: Optional[List[PrivateLinkResource]]

class PrivateLinkResource:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    group_id: Optional[str]
    required_members: Optional[List[str]]
    required_zone_names: Optional[List[str]]

class MHSMPrivateEndpointConnection:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    etag: Optional[str]
    properties: Optional[MHSMPrivateEndpointConnectionProperties]

class MHSMPrivateLinkResourceListResult:
    value: Optional[List[MHSMPrivateLinkResource]]

class MHSMPrivateLinkResource:
    id: Optional[str]
    name: Optional[str]
    type: Optional[str]
    group_id: Optional[str]
    required_members: Optional[List[str]]
    required_zone_names: Optional[List[str]]

class MHSMGeoReplicatedRegion:
    name: Optional[str]
    provisioning_state: Optional[str]
    is_primary: Optional[bool]

Operation Results

class LROPoller:
    def result(self, timeout: Optional[float] = None) -> T: ...
    def done(self) -> bool: ...
    def wait(self, timeout: Optional[float] = None) -> None: ...

class ItemPaged:
    def __iter__(self) -> Iterator[T]: ...
    def by_page(self) -> Iterator[List[T]]: ...

Error Handling

The client raises Azure-specific exceptions for different error conditions:

from azure.core.exceptions import (
    HttpResponseError,
    ResourceNotFoundError, 
    ResourceExistsError,
    ClientAuthenticationError
)

try:
    vault = client.vaults.get(resource_group_name, vault_name)
except ResourceNotFoundError:
    print("Vault not found")
except ClientAuthenticationError:
    print("Authentication failed")
except HttpResponseError as e:
    print(f"HTTP error: {e.status_code} - {e.message}")

Async Support

Full async support is available through the aio module:

from azure.mgmt.keyvault.aio import KeyVaultManagementClient
from azure.identity.aio import DefaultAzureCredential

async def manage_vault():
    credential = DefaultAzureCredential()
    async with KeyVaultManagementClient(credential, subscription_id) as client:
        vault = await client.vaults.get(resource_group_name, vault_name)
        print(f"Vault: {vault.name}")