Azure Key Vault Secrets for Java
Guides Java developers through secure storage, retrieval, rotation, recovery, and backup of application secrets in Azure Key Vault.
The material clearly concerns Azure Key Vault secrets and includes partial safeguards such as DefaultAzureCredential, least-privilege guidance, soft delete, logging, and environment variables. However, examples print secret values, embed realistic secret-shaped values in source, retrieve and output many secrets, and perform purge, delete, and file backup operations without confirmation, permission scoping, protected backup handling, or rollback guidance, warranting substantial deductions.
The main document covers synchronous and asynchronous usage, error handling, deletion, and recovery, with an additional examples reference. However, dependency versions differ between 4.9.0 and 4.11.0-beta.1, several snippets omit imports, API behavior is not validated by skill-specific tests, and handling of abnormal input, retries, idempotency, and diagnostic failures is thin. Static calibration keeps this below 10.
The audience and trigger phrases are fairly clear, covering Java secret storage, retrieval, rotation, deletion, recovery, backup, and async SDK use. It does not define non-fit cases, required Azure resources or RBAC setup, network or regional constraints, Chinese-language guidance, or mainland-China reachability considerations, so boundary and environment-fit evidence is limited.
The skill has front matter, MIT licensing, a version field, installation instructions, organized examples, environment variables, best practices, error handling, and a separate reference file. Deductions apply because maintenance ownership, changelog, SDK/identity compatibility matrix, troubleshooting guidance, and safe secret-handling examples are incomplete, while the main and reference documents show version drift.
For a Java developer who already has Azure identity and a Key Vault, the material plausibly supports core CRUD, versioning, rotation, recovery, and backup tasks. Its direct usability is reduced by compileability and dependency-version concerns, unsafe copy-paste patterns, and missing complete project configuration, RBAC prerequisites, and verified outputs. Static calibration supports a core-task score no higher than 7.
The snippets, dependency coordinates, exception types, and operation patterns are auditable, and the repository supplies generic CI and test infrastructure. The provided CI and tests do not specifically cover this Java Key Vault skill's key paths, and there are no skill-specific execution results, independent corroboration, or changelog evidence. Static calibration therefore permits only limited credit.
- Do not copy realistic secret values or print secret values from the examples; use placeholders, prevent log disclosure, and restrict read permissions.
- purgeDeletedSecret is irreversible and should require explicit confirmation, scoped permissions, and a documented recovery strategy.
- Align the azure-security-keyvault-secrets and azure-identity versions and compile-check every example in the target Java/Maven environment.
- Document Key Vault, RBAC, soft-delete, network-access, rotation-failure, backup-encryption, and prerequisite troubleshooting details.
What does this skill do, and when should you use it?
This skill is for Java developers using the Azure Key Vault Secrets SDK to manage sensitive configuration. It covers passwords, API keys, connection strings, and other string secrets across creation, retrieval, property updates, listing, deletion, recovery, purge, and backup and restore. It includes both synchronous and asynchronous client examples, along with DefaultAzureCredential and managed identity setup. It fits projects already using Azure Key Vault, but does not replace resource provisioning, access-policy configuration, or production operations guidance.
Guides the agent to add the Maven dependency com.azure:azure-security-keyvault-secrets:4.9.0, create synchronous or asynchronous SecretClient instances, connect to a vault with Azure credentials, set and retrieve latest or versioned secrets, update enabled status, expiry, tags, and content type, list secrets and versions, delete, recover, and purge secrets, and back up or restore secrets as byte arrays. It also provides patterns for loading multiple secrets, rotating versions, and handling ResourceNotFoundException and HttpResponseException.
- A Java backend developer needs to move database passwords, API keys, or connection strings out of source code and application configuration into Azure Key Vault.
- A production team needs a basic rotation flow that disables an old secret version and creates a new version with a replacement value.
- A developer needs to inspect secret metadata, versions, enabled state, and timestamps without listing secret values.
- An operations or application team needs to manage accidental deletion through soft delete, recovery, and permanent purge operations.
- A Java application needs to back up or restore all versions of a Key Vault secret.
What are this skill's strengths and limitations?
- Covers the secret lifecycle from creation and retrieval through versioning, property updates, deletion, recovery, purge, and backup or restore.
- Provides both synchronous and asynchronous Java client patterns.
- Includes concrete practices for expiry, tags, content type, soft delete, least privilege, and diagnostic logging.
- Includes patterns for bulk loading, rotation, and common HTTP failure handling.
- The examples assume an existing and reachable Azure Key Vault; they do not explain resource creation, authorization, or network isolation.
- The backup example writes secret backup data to a local file, so the application must secure that file itself.
- The README’s test-coverage statistics describe the repository as a whole and do not establish independent test coverage for this skill.
- The sample passwords and key values are illustrative and must not be reused as production credentials.
How do you install this skill?
Run npx skills add microsoft/skills and select azure-security-keyvault-secrets-java in the installation wizard. The README says skills are installed into the selected agent directory, such as .github/skills/ for GitHub Copilot, and can be symlinked for multiple agents. The source does not document a standalone installation command for this skill or Azure resource permission setup.
How do you use this skill?
After loading the skill in a coding agent, ask for requests such as “use the Java Key Vault Secrets SDK to store an API key,” “retrieve a connection string from Azure Key Vault,” or “implement secret rotation.” The code must provide a vault URL such as https://<vault-name>.vault.azure.net and configure AZURE_KEYVAULT_URL; when using DefaultAzureCredential in production, follow the example’s AZURE_TOKEN_CREDENTIALS=prod or specific-credential configuration.