Azure Keyvault Secrets Rust

1---
2name: azure-keyvault-secrets-rust
3description: |
4  Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys.
5  Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".
6package: azure_security_keyvault_secrets
7---
8 
9# Azure Key Vault Secrets SDK for Rust
10 
11Client library for Azure Key Vault Secrets — secure storage for passwords, API keys, and other secrets.
12 
13## Installation
14 
15```sh
16cargo add azure_security_keyvault_secrets azure_identity
17```
18 
19## Environment Variables
20 
21```bash
22AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/
23```
24 
25## Authentication
26 
27```rust
28use azure_identity::DeveloperToolsCredential;
29use azure_security_keyvault_secrets::SecretClient;
30 
31let credential = DeveloperToolsCredential::new(None)?;
32let client = SecretClient::new(
33    "https://<vault-name>.vault.azure.net/",
34    credential.clone(),
35    None,
36)?;
37```
38 
39## Core Operations
40 
41### Get Secret
42 
43```rust
44let secret = client
45    .get_secret("secret-name", None)
46    .await?
47    .into_model()?;
48 
49println!("Secret value: {:?}", secret.value);
50```
51 
52### Set Secret
53 
54```rust
55use azure_security_keyvault_secrets::models::SetSecretParameters;
56 
57let params = SetSecretParameters {
58    value: Some("secret-value".into()),
59    ..Default::default()
60};
61 
62let secret = client
63    .set_secret("secret-name", params.try_into()?, None)
64    .await?
65    .into_model()?;
66```
67 
68### Update Secret Properties
69 
70```rust
71use azure_security_keyvault_secrets::models::UpdateSecretPropertiesParameters;
72use std::collections::HashMap;
73 
74let params = UpdateSecretPropertiesParameters {
75    content_type: Some("text/plain".into()),
76    tags: Some(HashMap::from([("env".into(), "prod".into())])),
77    ..Default::default()
78};
79 
80client
81    .update_secret_properties("secret-name", params.try_into()?, None)
82    .await?;
83```
84 
85### Delete Secret
86 
87```rust
88client.delete_secret("secret-name", None).await?;
89```
90 
91### List Secrets
92 
93```rust
94use azure_security_keyvault_secrets::ResourceExt;
95use futures::TryStreamExt;
96 
97let mut pager = client.list_secret_properties(None)?.into_stream();
98while let Some(secret) = pager.try_next().await? {
99    let name = secret.resource_id()?.name;
100    println!("Secret: {}", name);
101}
102```
103 
104### Get Specific Version
105 
106```rust
107use azure_security_keyvault_secrets::models::SecretClientGetSecretOptions;
108 
109let options = SecretClientGetSecretOptions {
110    secret_version: Some("version-id".into()),
111    ..Default::default()
112};
113 
114let secret = client
115    .get_secret("secret-name", Some(options))
116    .await?
117    .into_model()?;
118```
119 
120## Best Practices
121 
1221. **Use Entra ID auth** — `DeveloperToolsCredential` for dev, `ManagedIdentityCredential` for production
1232. **Use `into_model()?`** — to deserialize responses
1243. **Use `ResourceExt` trait** — for extracting names from IDs
1254. **Handle soft delete** — deleted secrets can be recovered within retention period
1265. **Set content type** — helps identify secret format
1276. **Use tags** — for organizing and filtering secrets
1287. **Version secrets** — new values create new versions automatically
129 
130## RBAC Permissions
131 
132Assign these Key Vault roles:
133- `Key Vault Secrets User` — get and list
134- `Key Vault Secrets Officer` — full CRUD
135 
136## Reference Links
137 
138| Resource | Link |
139|----------|------|
140| API Reference | https://docs.rs/azure_security_keyvault_secrets |
141| Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_secrets |
142| crates.io | https://crates.io/crates/azure_security_keyvault_secrets |
143