Azure Keyvault Keys Rust

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Software development
MIT
No issues found

From the author

Azure Key Vault Keys library for Rust. Create, manage, and use cryptographic keys including RSA, EC, and HSM-protected keys. Triggers: "keyvault keys rust", "KeyClient rust", "create key rust", "encrypt rust", "wrap key rust", "sign rust".

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides instructions for integrating the official Azure Key Vault Keys library for Rust into your applications. It covers the setup, authentication, and core workflows for managing RSA, EC, and HSM-protected keys. The guide emphasizes secure practices, such as using managed identities for production and leveraging the library's built-in support for cryptographic operations like wrapping, unwrapping, and signing, ensuring that sensitive private keys remain protected within the HSM.

What it does

Provides setup and installation steps for the azure_security_keyvault_keys crate.
Demonstrates how to create, update, and delete cryptographic keys in Azure Key Vault.
Explains how to perform envelope encryption using wrap and unwrap operations.
Details authentication methods using DeveloperToolsCredential and ManagedIdentityCredential.
Offers guidance on managing key properties and iterating through key lists with pagination.
Outlines best practices for dependency management and client reuse in Rust.

When to use it

When you need to integrate Azure Key Vault into a Rust-based backend application.
When your application requires secure, HSM-backed cryptographic operations.
When implementing envelope encryption to protect data encryption keys.
When you need to manage key lifecycles, including creation and property updates, programmatically.

Advantages

Enables secure, server-side cryptographic operations where private keys never leave the HSM.
Provides a structured approach to handling Azure authentication in Rust environments.
Includes clear examples for complex operations like key wrapping and pagination.
Promotes the use of official, supported SDK crates for security and stability.

Usage examples

“How do I initialize a KeyClient in Rust for Azure Key Vault?”: The agent provides a code snippet using DeveloperToolsCredential and the KeyClient constructor, including the necessary imports and environment variable configuration.
“Show me how to create an EC key in Azure Key Vault using Rust.”: The agent provides a code example using CreateKeyParameters with the appropriate KeyType and CurveName settings.
“How do I perform envelope encryption with a Key Vault key in Rust?”: The agent provides a step-by-step example of generating a symmetric key, wrapping it with a Key Encryption Key (KEK), and unwrapping it using the KeyClient.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-keyvault-keys-rust/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-keyvault-keys-rust.zip -d .agents/skills

Documentation by Microsoft

Azure Key Vault Keys library for Rust

Secure storage and management of cryptographic keys — RSA, EC, and HSM-protected.

Use this skill when:

An app needs to create or manage cryptographic keys in Key Vault from Rust
You need to wrap/unwrap data encryption keys (envelope encryption)
You need to sign or verify data with Key Vault keys
You need HSM-protected keys

IMPORTANT: Only use the official azure_security_keyvault_keys crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

cargo add azure_security_keyvault_keys azure_identity tokio futures

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_keys re-exports, direct azure_core dependency is optional.

Environment Variables

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ # Required for all operations

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_keys::KeyClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.
    let credential = DeveloperToolsCredential::new(None)?;
    let client = KeyClient::new(
        "https://<vault-name>.vault.azure.net/",
        credential.clone(),
        None,
    )?;

    let key = client.get_key("key-name", None).await?.into_model()?;
    println!("Key: {:?}", key.key);
    Ok(())
}

Prefer the crate README/examples when checking public operation shapes such as key creation, wrapping, and version-aware unwrap flows.

Core Workflow

Create Key

use azure_security_keyvault_keys::{
    models::{CreateKeyParameters, CurveName, KeyType},
    ResourceExt,
};

// Create an EC key
let body = CreateKeyParameters {
    kty: Some(KeyType::Ec),
    curve: Some(CurveName::P256),
    ..Default::default()
};

let key = client
    .create_key("key-name", body.try_into()?, None)
    .await?
    .into_model()?;

println!(
    "Name: {:?}, Type: {:?}, Version: {:?}",
    key.resource_id()?.name,
    key.key.as_ref().map(|k| k.kty.as_ref()),
    key.resource_id()?.version,
);

Update Key Properties

use azure_security_keyvault_keys::models::UpdateKeyPropertiesParameters;
use std::collections::HashMap;

#[allow(clippy::needless_update)]
let params = UpdateKeyPropertiesParameters {
    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),
    ..Default::default()
};

client
    .update_key_properties("key-name", params.try_into()?, None)
    .await?
    .into_model()?;

Delete Key

client.delete_key("key-name", None).await?;

List Keys (Pagination)

list_key_properties returns a Pager<T> — iterate items directly:

use azure_security_keyvault_keys::ResourceExt;
use futures::TryStreamExt as _;

let mut pager = client.list_key_properties(None)?;
while let Some(key) = pager.try_next().await? {
    println!("Found: {}", key.resource_id()?.name);
}

Wrap / Unwrap (Envelope Encryption)

Key Vault performs crypto operations server-side — the private key never leaves the HSM:

use azure_security_keyvault_keys::{
    models::{
        CreateKeyParameters, EncryptionAlgorithm, KeyOperationParameters, KeyType,
    },
    ResourceExt, ResourceId,
};
use rand::random;

// Create a key encryption key (KEK)
let body = CreateKeyParameters {
    kty: Some(KeyType::Rsa),
    key_size: Some(2048),
    ..Default::default()
};

let key = client
    .create_key("kek-name", body.try_into()?, None)
    .await?
    .into_model()?;

// Generate a symmetric data encryption key (DEK)
let dek = random::<u32>().to_le_bytes().to_vec();

// Wrap the DEK with the KEK
let mut params = KeyOperationParameters {
    algorithm: Some(EncryptionAlgorithm::RsaOaep256),
    value: Some(dek.clone()),
    ..Default::default()
};
let wrapped = client
    .wrap_key("kek-name", params.clone().try_into()?, None)
    .await?
    .into_model()?;

// Retain the key version used to wrap so you can unwrap with the same version later
let ResourceId { version, .. } = wrapped.resource_id()?;
let key_version = version.as_deref().unwrap_or_default();

// Unwrap to recover the DEK
params.value = wrapped.result;
let unwrapped = client
    .unwrap_key("kek-name", key_version, params.try_into()?, None)
    .await?
    .into_model()?;

assert!(matches!(unwrapped.result, Some(ref result) if result.eq(&dek)));

Key Types

Type	Use Case	Parameter
EC	Signing, key agreement	`KeyType::Ec`
RSA	Encryption, signing, wrapping	`KeyType::Rsa`
Oct	Symmetric operations (HSM)	`KeyType::Oct`
EC-HSM	HSM-protected EC keys	`KeyType::EcHsm`
RSA-HSM	HSM-protected RSA keys	`KeyType::RsaHsm`

RBAC Roles

For Entra ID auth, assign one of these roles:

Role	Access
`Key Vault Crypto User`	Use keys for crypto ops
`Key Vault Crypto Officer`	Full key management

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract key name/version from key IDs
Reuse clients — KeyClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_keys/latest/azure_security_keyvault_keys
crates.io	https://crates.io/crates/azure_security_keyvault_keys
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_keys

Files

ATTRIBUTION.mdAdded by AutoGineer979 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md7.4 KiB

SKILL.md

Azure Key Vault Keys library for Rust

Secure storage and management of cryptographic keys — RSA, EC, and HSM-protected.

Use this skill when:

An app needs to create or manage cryptographic keys in Key Vault from Rust
You need to wrap/unwrap data encryption keys (envelope encryption)
You need to sign or verify data with Key Vault keys
You need HSM-protected keys

IMPORTANT: Only use the official azure_security_keyvault_keys crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

cargo add azure_security_keyvault_keys azure_identity tokio futures

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_keys re-exports, direct azure_core dependency is optional.

Environment Variables

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ # Required for all operations

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_keys::KeyClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.
    let credential = DeveloperToolsCredential::new(None)?;
    let client = KeyClient::new(
        "https://<vault-name>.vault.azure.net/",
        credential.clone(),
        None,
    )?;

    let key = client.get_key("key-name", None).await?.into_model()?;
    println!("Key: {:?}", key.key);
    Ok(())
}

Prefer the crate README/examples when checking public operation shapes such as key creation, wrapping, and version-aware unwrap flows.

Core Workflow

Create Key

use azure_security_keyvault_keys::{
    models::{CreateKeyParameters, CurveName, KeyType},
    ResourceExt,
};

// Create an EC key
let body = CreateKeyParameters {
    kty: Some(KeyType::Ec),
    curve: Some(CurveName::P256),
    ..Default::default()
};

let key = client
    .create_key("key-name", body.try_into()?, None)
    .await?
    .into_model()?;

println!(
    "Name: {:?}, Type: {:?}, Version: {:?}",
    key.resource_id()?.name,
    key.key.as_ref().map(|k| k.kty.as_ref()),
    key.resource_id()?.version,
);

Update Key Properties

use azure_security_keyvault_keys::models::UpdateKeyPropertiesParameters;
use std::collections::HashMap;

#[allow(clippy::needless_update)]
let params = UpdateKeyPropertiesParameters {
    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),
    ..Default::default()
};

client
    .update_key_properties("key-name", params.try_into()?, None)
    .await?
    .into_model()?;

Delete Key

client.delete_key("key-name", None).await?;

List Keys (Pagination)

list_key_properties returns a Pager<T> — iterate items directly:

use azure_security_keyvault_keys::ResourceExt;
use futures::TryStreamExt as _;

let mut pager = client.list_key_properties(None)?;
while let Some(key) = pager.try_next().await? {
    println!("Found: {}", key.resource_id()?.name);
}

Wrap / Unwrap (Envelope Encryption)

Key Vault performs crypto operations server-side — the private key never leaves the HSM:

use azure_security_keyvault_keys::{
    models::{
        CreateKeyParameters, EncryptionAlgorithm, KeyOperationParameters, KeyType,
    },
    ResourceExt, ResourceId,
};
use rand::random;

// Create a key encryption key (KEK)
let body = CreateKeyParameters {
    kty: Some(KeyType::Rsa),
    key_size: Some(2048),
    ..Default::default()
};

let key = client
    .create_key("kek-name", body.try_into()?, None)
    .await?
    .into_model()?;

// Generate a symmetric data encryption key (DEK)
let dek = random::<u32>().to_le_bytes().to_vec();

// Wrap the DEK with the KEK
let mut params = KeyOperationParameters {
    algorithm: Some(EncryptionAlgorithm::RsaOaep256),
    value: Some(dek.clone()),
    ..Default::default()
};
let wrapped = client
    .wrap_key("kek-name", params.clone().try_into()?, None)
    .await?
    .into_model()?;

// Retain the key version used to wrap so you can unwrap with the same version later
let ResourceId { version, .. } = wrapped.resource_id()?;
let key_version = version.as_deref().unwrap_or_default();

// Unwrap to recover the DEK
params.value = wrapped.result;
let unwrapped = client
    .unwrap_key("kek-name", key_version, params.try_into()?, None)
    .await?
    .into_model()?;

assert!(matches!(unwrapped.result, Some(ref result) if result.eq(&dek)));

Key Types

Type	Use Case	Parameter
EC	Signing, key agreement	`KeyType::Ec`
RSA	Encryption, signing, wrapping	`KeyType::Rsa`
Oct	Symmetric operations (HSM)	`KeyType::Oct`
EC-HSM	HSM-protected EC keys	`KeyType::EcHsm`
RSA-HSM	HSM-protected RSA keys	`KeyType::RsaHsm`

RBAC Roles

For Entra ID auth, assign one of these roles:

Role	Access
`Key Vault Crypto User`	Use keys for crypto ops
`Key Vault Crypto Officer`	Full key management

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract key name/version from key IDs
Reuse clients — KeyClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_keys/latest/azure_security_keyvault_keys
crates.io	https://crates.io/crates/azure_security_keyvault_keys
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_keys

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-sdk-rust/skills/azure-keyvault-keys-rust · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-keyvault-keys-rust.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Key Vault Keys library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Key

Update Key Properties

Delete Key

List Keys (Pagination)

Wrap / Unwrap (Envelope Encryption)

Key Types

RBAC Roles

Best Practices

Reference Links

Files

SKILL.md

Azure Key Vault Keys library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Key

Update Key Properties

Delete Key

List Keys (Pagination)

Wrap / Unwrap (Envelope Encryption)

Key Types

RBAC Roles

Best Practices

Reference Links

Requirements and compatibility

Security

Attribution and licence

Related skills

Implement Spec

MCP Builder

Schema

Postgresql Table Design

SQL Optimization Patterns

API Scaffolding Fastapi Pro

Download ZIP