AutoGineer
Generated banner for Azure Keyvault Secrets Rust
Generated logo for Azure Keyvault Secrets Rust

Azure Keyvault Secrets Rust

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Tool integration
  • Software development
  • MIT
  • No issues found
Download ZIP

From the author

Azure Key Vault Secrets library for Rust. Store and retrieve secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust", "list secrets rust".
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides guidance and code examples for using the official Azure Key Vault Secrets library for Rust. It covers the essential operations for managing secrets, including retrieval, creation, updates, deletion, and paginated listing. The documentation emphasizes proper authentication patterns for Rust, specifically using DeveloperToolsCredential for local development and ManagedIdentityCredential for production environments, while providing best practices for dependency management and client reuse.

What it does

  • Retrieves secret values from Azure Key Vault
  • Creates or updates secrets and their properties
  • Deletes secrets from the vault
  • Lists secret properties using paginated streams
  • Provides patterns for authentication using Azure Identity
  • Offers error handling strategies for secret operations

When to use it

  • When building Rust applications that require secure storage for API keys or passwords
  • When you need to integrate Azure Key Vault into a Rust-based service
  • When you need to manage secret metadata and tags programmatically
  • When you need to implement secure secret access using managed identities

Advantages

  • Uses the official Azure SDK for Rust
  • Provides thread-safe client implementation
  • Includes clear patterns for local versus production authentication
  • Supports structured error handling for API responses

Usage examples

“How do I retrieve a secret from Azure Key Vault in Rust?”
The agent provides a code snippet using SecretClient and DeveloperToolsCredential to fetch a secret value by its name.
“Show me how to list all secrets in my vault using Rust.”
The agent demonstrates using list_secret_properties with a pager and the futures crate to iterate through secret resources.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/microsoft/azure-keyvault-secrets-rust/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-keyvault-secrets-rust.zip -d .agents/skills

Documentation by Microsoft

Azure Key Vault Secrets library for Rust

Secure storage for passwords, API keys, and connection strings.

Use this skill when:

  • An app needs to store or retrieve secrets from Azure Key Vault in Rust

  • You need to set, get, update, or delete secrets

  • You need to list secret properties with pagination

  • You need error handling for missing secrets

IMPORTANT: Only use the official azure_security_keyvault_secrets crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

cargo add azure_security_keyvault_secrets azure_identity tokio futures

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_secrets re-exports, direct azure_core dependency is optional.

Environment Variables

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ # Required for all operations

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_secrets::SecretClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.
    let credential = DeveloperToolsCredential::new(None)?;
    let client = SecretClient::new(
        "https://<vault-name>.vault.azure.net/",
        credential.clone(),
        None,
    )?;

    let secret = client
        .get_secret("secret-name", None)
        .await?
        .into_model()?;
    println!("Secret: {:?}", secret.value);
    Ok(())
}

Prefer the crate README/examples when checking whether pagers yield items directly and how ResourceExt is used in public examples.

Core Workflow

Set Secret
use azure_security_keyvault_secrets::{models::SetSecretParameters, ResourceExt};

let params = SetSecretParameters {
    value: Some("secret-value".into()),
    ..Default::default()
};

let secret = client
    .set_secret("secret-name", params.try_into()?, None)
    .await?
    .into_model()?;

println!(
    "Name: {:?}, Version: {:?}",
    secret.resource_id()?.name,
    secret.resource_id()?.version
);
Update Secret Properties
use azure_security_keyvault_secrets::models::UpdateSecretPropertiesParameters;
use std::collections::HashMap;

#[allow(clippy::needless_update)]
let params = UpdateSecretPropertiesParameters {
    content_type: Some("text/plain".into()),
    tags: Some(HashMap::from_iter(vec![(
        "env".into(),
        "prod".into(),
    )])),
    ..Default::default()
};

client
    .update_secret_properties("secret-name", params.try_into()?, None)
    .await?
    .into_model()?;
Delete Secret
client.delete_secret("secret-name", None).await?;
List Secrets (Pagination)

list_secret_properties returns a Pager<T> — iterate items directly:

use azure_security_keyvault_secrets::ResourceExt;
use futures::TryStreamExt as _;

let mut pager = client.list_secret_properties(None)?;
while let Some(secret) = pager.try_next().await? {
    println!("Found: {}", secret.resource_id()?.name);
}

Error Handling

match client.get_secret("secret-name", None).await {
    Ok(response) => println!("Secret Value: {:?}", response.into_model()?.value),
    Err(err) => println!("Error: {:#?}", err.into_inner()?),
}

// Error output includes structured ErrorResponse with code and message

RBAC Roles

For Entra ID auth, assign one of these roles:

RoleAccess
Key Vault Secrets UserRead secrets
Key Vault Secrets OfficerFull secret management

Best Practices

  1. Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.

  2. Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.

  3. Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type

  4. Never hardcode credentials — use environment variables or managed identity

  5. Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates

  6. Use ResourceExt to extract resource name/version from secret IDs

  7. Reuse clients — SecretClient is thread-safe; create once, share across tasks

  8. Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

ResourceLink
API Referencehttps://docs.rs/azure_security_keyvault_secrets/latest/azure_security_keyvault_secrets
crates.iohttps://crates.io/crates/azure_security_keyvault_secrets
Source Codehttps://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_secrets

Files

LICENSE

    MIT License

    Copyright (c) Microsoft Corporation.

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-sdk-rust/skills/azure-keyvault-secrets-rust · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-keyvault-secrets-rust.zip