Azure Key Vault Keys for Rust
A practical Rust guide for creating, managing, and using RSA, EC, and HSM-protected keys in Azure Key Vault.
The skill restricts users to the official crate, recommends managed identity in production, forbids hardcoded credentials, and states that private keys remain server-side. However, deletion has no confirmation, retention, or recovery procedure; sensitive DEK handling is underexplained; and the sample generates a DEK from a random u32, so trust is materially deducted.
Installation, authentication, CRUD, pagination, and wrapping workflows are internally coherent. The skill contains no dedicated tests, version pinning, abnormal-input handling, or diagnostic failure examples, so configuration and API failures are largely delegated to the SDK; the static ceiling also applies.
Triggers and intended Rust/Key Vault scenarios are reasonably clear, including key management, wrapping, signing, and HSM use. Non-fit boundaries, complete Azure-resource prerequisites, permission prerequisites, Chinese-language support, and mainland-China network reachability are not specified, so points are deducted.
The document is layered into installation, environment, authentication, workflows, key types, RBAC, practices, and references, with clear MIT and author metadata. It lacks a crate-version policy, changelog, explicit maintenance owner/update path, and troubleshooting guidance; examples also assume omitted surrounding context.
The skill covers common Key Vault Keys operations and offers directly useful snippets for experienced Azure Rust developers. It lacks a statically verifiable complete project result, uses a production-inappropriate DEK example, and omits complete rotation, recovery, signing, and failure-handling guidance, limiting the score.
The skill cites docs.rs, crates.io, and the Azure SDK source, while the repository material shows general CI, evaluation, and test infrastructure. No skill-specific tests or third-party execution evidence are provided, so key paths cannot be independently reproduced from the supplied material.
- Do not use the sample random-u32 method for production DEKs; use an audited cryptographic RNG and define the key lifecycle explicitly.
- Add confirmation, soft-delete/recovery handling, and permission review before delete_key; these safeguards are not documented.
- The examples depend on Azure Key Vault, Entra ID, RBAC, and reachable external services; mainland-China reachability and offline alternatives are unspecified.
- Compile against a pinned crate version and run project-level tests before use; this review did not execute the code.
What does this skill do, and when should you use it?
This skill helps Rust developers use the Azure SDK for Azure Key Vault cryptographic keys. It covers key creation, property updates, deletion, pagination, and server-side cryptographic operations. The documented key types include RSA, EC, symmetric, and HSM-protected variants, with an envelope-encryption wrap/unwrap example. It requires the official azure_security_keyvault_keys crate and explains local development, production authentication, and Entra ID RBAC roles.
Guides installation of azure_security_keyvault_keys, azure_identity, tokio, and futures; creates a KeyClient with DeveloperToolsCredential; connects to Key Vault using AZURE_KEYVAULT_URL; creates EC or RSA keys, updates properties such as tags, deletes keys, and lists key properties with pagination; calls wrap_key and unwrap_key for envelope encryption; extracts key names and versions with ResourceExt; and identifies scenarios for signing or verifying data with Key Vault keys.
- A Rust developer building an Azure application that must create or manage RSA or EC keys in Key Vault.
- A team implementing envelope encryption that wraps and unwraps data-encryption keys through Key Vault.
- A security developer that needs to sign or verify data with Key Vault keys.
- A security engineering team that requires HSM-protected RSA, EC, or symmetric keys.
What are this skill's strengths and limitations?
- Covers the core Key Vault key lifecycle: creation, updates, deletion, and listing.
- Documents RSA, EC, Oct, EC-HSM, and RSA-HSM key types.
- Includes copyable Cargo and Rust examples and explicitly requires the official crate.
- Explains key-version retention, ResourceExt, client reuse, and local versus production authentication.
- Its scope is Key Vault Keys; it does not cover Key Vault secrets or certificates.
- Real operations require Azure Key Vault, valid authentication, and suitable RBAC configuration.
- The README’s test-coverage summary does not provide explicit evidence of dedicated tests for this Rust skill.
- The source provides no pricing, performance benchmarks, or troubleshooting guide.
How do you install this skill?
Install the repository’s skill collection with npx skills add microsoft/skills, then select the required skill in the wizard; skills are installed into the selected agent’s directory, such as .github/skills/ for GitHub Copilot. Add Rust dependencies with cargo add azure_security_keyvault_keys azure_identity tokio futures. Add azure_core only when importing its types directly.
How do you use this skill?
Use a trigger such as keyvault keys rust, KeyClient rust, create key rust, encrypt rust, wrap key rust, or sign rust. Set the required variable AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/, then create a KeyClient with DeveloperToolsCredential as shown. Use ManagedIdentityCredential in production. For Entra ID access, assign Key Vault Crypto User or Key Vault Crypto Officer as appropriate.