Azure Keyvault Keys Rust

1---
2name: azure-keyvault-keys-rust
3description: |
4  Azure Key Vault Keys SDK for Rust. Use for creating, managing, and using cryptographic keys.
5  Triggers: "keyvault keys rust", "KeyClient rust", "create key rust", "encrypt rust", "sign rust".
6package: azure_security_keyvault_keys
7---
8 
9# Azure Key Vault Keys SDK for Rust
10 
11Client library for Azure Key Vault Keys — secure storage and management of cryptographic keys.
12 
13## Installation
14 
15```sh
16cargo add azure_security_keyvault_keys azure_identity
17```
18 
19## Environment Variables
20 
21```bash
22AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/
23```
24 
25## Authentication
26 
27```rust
28use azure_identity::DeveloperToolsCredential;
29use azure_security_keyvault_keys::KeyClient;
30 
31let credential = DeveloperToolsCredential::new(None)?;
32let client = KeyClient::new(
33    "https://<vault-name>.vault.azure.net/",
34    credential.clone(),
35    None,
36)?;
37```
38 
39## Key Types
40 
41| Type | Description |
42|------|-------------|
43| RSA | RSA keys (2048, 3072, 4096 bits) |
44| EC | Elliptic curve keys (P-256, P-384, P-521) |
45| RSA-HSM | HSM-protected RSA keys |
46| EC-HSM | HSM-protected EC keys |
47 
48## Core Operations
49 
50### Get Key
51 
52```rust
53let key = client
54    .get_key("key-name", None)
55    .await?
56    .into_model()?;
57 
58println!("Key ID: {:?}", key.key.as_ref().map(|k| &k.kid));
59```
60 
61### Create Key
62 
63```rust
64use azure_security_keyvault_keys::models::{CreateKeyParameters, KeyType};
65 
66let params = CreateKeyParameters {
67    kty: KeyType::Rsa,
68    key_size: Some(2048),
69    ..Default::default()
70};
71 
72let key = client
73    .create_key("key-name", params.try_into()?, None)
74    .await?
75    .into_model()?;
76```
77 
78### Create EC Key
79 
80```rust
81use azure_security_keyvault_keys::models::{CreateKeyParameters, KeyType, CurveName};
82 
83let params = CreateKeyParameters {
84    kty: KeyType::Ec,
85    curve: Some(CurveName::P256),
86    ..Default::default()
87};
88 
89let key = client
90    .create_key("ec-key", params.try_into()?, None)
91    .await?
92    .into_model()?;
93```
94 
95### Delete Key
96 
97```rust
98client.delete_key("key-name", None).await?;
99```
100 
101### List Keys
102 
103```rust
104use azure_security_keyvault_keys::ResourceExt;
105use futures::TryStreamExt;
106 
107let mut pager = client.list_key_properties(None)?.into_stream();
108while let Some(key) = pager.try_next().await? {
109    let name = key.resource_id()?.name;
110    println!("Key: {}", name);
111}
112```
113 
114### Backup Key
115 
116```rust
117let backup = client.backup_key("key-name", None).await?;
118// Store backup.value safely
119```
120 
121### Restore Key
122 
123```rust
124use azure_security_keyvault_keys::models::RestoreKeyParameters;
125 
126let params = RestoreKeyParameters {
127    key_bundle_backup: backup_bytes,
128};
129 
130client.restore_key(params.try_into()?, None).await?;
131```
132 
133## Cryptographic Operations
134 
135Key Vault can perform crypto operations without exposing the private key:
136 
137```rust
138// For cryptographic operations, use the key's operations
139// Available operations depend on key type and permissions:
140// - encrypt/decrypt (RSA)
141// - sign/verify (RSA, EC)
142// - wrapKey/unwrapKey (RSA)
143```
144 
145## Best Practices
146 
1471. **Use Entra ID auth** — `DeveloperToolsCredential` for dev, `ManagedIdentityCredential` for production
1482. **Use HSM keys for sensitive workloads** — hardware-protected keys
1493. **Use EC for signing** — more efficient than RSA
1504. **Use RSA for encryption** — when encrypting data
1515. **Backup keys** — for disaster recovery
1526. **Enable soft delete** — required for production vaults
1537. **Use key rotation** — create new versions periodically
154 
155## RBAC Permissions
156 
157Assign these Key Vault roles:
158- `Key Vault Crypto User` — use keys for crypto operations
159- `Key Vault Crypto Officer` — full CRUD on keys
160 
161## Reference Links
162 
163| Resource | Link |
164|----------|------|
165| API Reference | https://docs.rs/azure_security_keyvault_keys |
166| Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_keys |
167| crates.io | https://crates.io/crates/azure_security_keyvault_keys |
168