Azure Key Vault Secrets for Rust
Guides Rust applications in securely storing and managing passwords, API keys, and connection strings in Azure Key Vault.
The document restricts use to the official crate, recommends managed identity, prohibits hardcoded credentials, and lists RBAC roles, providing basic permission and data-flow guidance. However, the example directly prints secret.value, does not warn against log disclosure, provides no confirmation or rollback/recovery guidance for deletion, and omits transport, audit, and sensitive-output handling; points are deducted.
The installation, authentication, get/set/update/delete, pagination, and error-handling paths are broadly consistent, and structured errors are mentioned. However, there are no skill-specific tests, pinned dependency versions, retry/timeout/network-failure guidance, or execution evidence; AZURE_KEYVAULT_URL is documented but not actually used in the client example. The static cap therefore applies.
Trigger phrases, Rust/Azure Key Vault scenarios, and main operations are reasonably clear, and local-versus-production identity guidance is included. Non-fit cases, input/output boundaries, deletion confirmation requirements, and Chinese/mainland-China environment fit are not specified; the core service also depends on Azure reachability, so points are deducted.
The SKILL.md has clear progressive sections for installation, environment variables, authentication, workflows, errors, RBAC, best practices, and references; license and author metadata are present. It lacks crate/SDK version policy, changelog, explicit maintenance owner/update path, and troubleshooting FAQs. The strong cargo add-only instruction also introduces an unnecessary workflow assumption.
The material covers common secret CRUD, pagination, and identity setup, so it can directly assist Rust SDK code generation. But the examples omit actual environment-variable URL loading, safe production output, deletion confirmation, and recovery considerations, and there is no execution validation for this skill; substantial manual security and correctness review remains.
The skill supplies auditable docs.rs, crates.io, and Azure SDK source references and identifies the official crate. However, references are not revision-pinned, and the supplied repository material shows no skill-specific reproducible tests or third-party execution results; the visible CI and harness evidence is largely generic, so static verifiability remains limited.
- The example prints the Key Vault secret value to standard output; production code should avoid logging secret material.
- Deletion has persistent external effects; the guidance should require explicit confirmation and explain recovery or soft-delete prerequisites.
- A compatible crate/SDK version should be pinned and the API examples verified against that version.
- AZURE_KEYVAULT_URL is declared required, but the example still uses a placeholder URL; safe loading and validation should be shown.
- Azure reachability and tenant authentication depend on external network and configuration; mainland-China connectivity is not addressed.
What it does & when to use it
This is a Rust SDK guidance skill from Microsoft's Agent Skills repository for Azure Key Vault Secrets. It focuses on the official azure_security_keyvault_secrets crate and explains client creation, authentication, and secret management. The skill covers setting, retrieving, updating, deleting, and paginating secret properties, along with missing-secret error handling. It fits developers already working with Rust and Azure Key Vault, but it does not provide a standalone test suite or complete application scaffold.
Guides an agent to write or modify Rust code that uses SecretClient to get, set, update, and delete Key Vault secrets; iterates through secret properties with a Pager; extracts secret names and versions with ResourceExt; configures DeveloperToolsCredential or ManagedIdentityCredential; handles structured errors containing codes and messages; and identifies the Entra ID roles Key Vault Secrets User and Key Vault Secrets Officer.
- A Rust developer needs to retrieve application passwords or API keys from Azure Key Vault.
- A backend team needs to create, update, or delete Key Vault secrets from a Rust service.
- An application must iterate through Key Vault secret properties with pagination.
- A developer needs separate local-development and production authentication patterns for Azure.
- A team needs guidance for diagnosing missing-secret and other Key Vault request errors.
Pros & cons
- Covers the basic lifecycle operations for Key Vault Secrets.
- Explicitly directs users to the official Azure SDK crate.
- Includes authentication, RBAC, pagination, and structured error-handling examples.
- Provides concrete guidance on model updates and reusing a thread-safe client.
- Limited to Rust Azure Key Vault Secrets; it does not cover keys or certificates.
- Requires an Azure Key Vault URL, credentials, and suitable RBAC permissions.
- The source does not specify version pinning, complete test scenarios, or offline operation.
- The collection README describes installation for the broader repository, not a standalone copy procedure for this plugin path.
How to install
This skill is part of the microsoft/skills collection. Run npx skills add microsoft/skills and select the required skill in the wizard; the collection is installed into the selected agent directory. The README does not document a standalone installation command for this Rust skill. For project dependencies, run cargo add azure_security_keyvault_secrets azure_identity tokio futures; add azure_core only when using its types directly.
How to use
Ask the coding agent for a task such as “use Rust and SecretClient to get a secret from Azure Key Vault” or “list Key Vault secrets with Rust pagination.” Set AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ and require the official azure_security_keyvault_secrets crate. Use DeveloperToolsCredential locally, ManagedIdentityCredential in production, and never hardcode credentials.