Azure Security Keyvault Keys Dotnet

using Azure.Identity;using Azure.Security.KeyVault.Keys;
var keyVaultName = Environment.GetEnvironmentVariable("KEY_VAULT_NAME");var kvUri = $"https://{keyVaultName}.vault.azure.net";
// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>var credential = new DefaultAzureCredential(    DefaultAzureCredential.DefaultEnvironmentVariableName);// Or use a specific credential directly in production:// See https://learn.microsoft.com/dotnet/api/overview/azure/identity-readme?view=azure-dotnet#credential-classes// var credential = new ManagedIdentityCredential();var client = new KeyClient(new Uri(kvUri), credential);

var credential = new ClientSecretCredential(    tenantId: "<tenant-id>",    clientId: "<client-id>",    clientSecret: "<client-secret>");
var client = new KeyClient(new Uri(kvUri), credential);

// Create RSA keyKeyVaultKey rsaKey = await client.CreateKeyAsync("my-rsa-key", KeyType.Rsa);Console.WriteLine($"Created key: {rsaKey.Name}, Type: {rsaKey.KeyType}");
// Create RSA key with optionsvar rsaOptions = new CreateRsaKeyOptions("my-rsa-key-2048"){    KeySize = 2048,    HardwareProtected = false, // true for HSM-backed    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),    NotBefore = DateTimeOffset.UtcNow,    Enabled = true};rsaOptions.KeyOperations.Add(KeyOperation.Encrypt);rsaOptions.KeyOperations.Add(KeyOperation.Decrypt);
KeyVaultKey rsaKey2 = await client.CreateRsaKeyAsync(rsaOptions);
// Create EC keyvar ecOptions = new CreateEcKeyOptions("my-ec-key"){    CurveName = KeyCurveName.P256,    HardwareProtected = true // HSM-backed};KeyVaultKey ecKey = await client.CreateEcKeyAsync(ecOptions);
// Create Oct (symmetric) key for wrap/unwrapvar octOptions = new CreateOctKeyOptions("my-oct-key"){    KeySize = 256,    HardwareProtected = true};KeyVaultKey octKey = await client.CreateOctKeyAsync(octOptions);

// Get specific key (latest version)KeyVaultKey key = await client.GetKeyAsync("my-rsa-key");Console.WriteLine($"Key ID: {key.Id}");Console.WriteLine($"Key Type: {key.KeyType}");Console.WriteLine($"Version: {key.Properties.Version}");
// Get specific versionKeyVaultKey keyVersion = await client.GetKeyAsync("my-rsa-key", "version-id");
// List all keysawait foreach (KeyProperties keyProps in client.GetPropertiesOfKeysAsync()){    Console.WriteLine($"Key: {keyProps.Name}, Enabled: {keyProps.Enabled}");}
// List key versionsawait foreach (KeyProperties version in client.GetPropertiesOfKeyVersionsAsync("my-rsa-key")){    Console.WriteLine($"Version: {version.Version}, Created: {version.CreatedOn}");}

KeyVaultKey key = await client.GetKeyAsync("my-rsa-key");
key.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddYears(2);key.Properties.Tags["environment"] = "production";
KeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(key.Properties);

// Start delete operationDeleteKeyOperation operation = await client.StartDeleteKeyAsync("my-rsa-key");
// Wait for deletion to complete (required before purge)await operation.WaitForCompletionAsync();Console.WriteLine($"Deleted key scheduled purge date: {operation.Value.ScheduledPurgeDate}");
// Purge immediately (if soft-delete is enabled)await client.PurgeDeletedKeyAsync("my-rsa-key");
// Or recover deleted keyKeyVaultKey recoveredKey = await client.StartRecoverDeletedKeyAsync("my-rsa-key");

// Backup keybyte[] backup = await client.BackupKeyAsync("my-rsa-key");await File.WriteAllBytesAsync("key-backup.bin", backup);
// Restore keybyte[] backupData = await File.ReadAllBytesAsync("key-backup.bin");KeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(backupData);

// From KeyClientKeyVaultKey key = await client.GetKeyAsync("my-rsa-key");CryptographyClient cryptoClient = client.GetCryptographyClient(    key.Name,     key.Properties.Version);
// Or create directly with key IDCryptographyClient cryptoClient = new CryptographyClient(    new Uri("https://myvault.vault.azure.net/keys/my-rsa-key/version"),    new DefaultAzureCredential());

byte[] plaintext = Encoding.UTF8.GetBytes("Secret message to encrypt");
// EncryptEncryptResult encryptResult = await cryptoClient.EncryptAsync(    EncryptionAlgorithm.RsaOaep256,     plaintext);Console.WriteLine($"Encrypted: {Convert.ToBase64String(encryptResult.Ciphertext)}");
// DecryptDecryptResult decryptResult = await cryptoClient.DecryptAsync(    EncryptionAlgorithm.RsaOaep256,     encryptResult.Ciphertext);string decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);Console.WriteLine($"Decrypted: {decrypted}");

// Key to wrap (e.g., AES key)byte[] keyToWrap = new byte[32]; // 256-bit keyRandomNumberGenerator.Fill(keyToWrap);
// Wrap keyWrapResult wrapResult = await cryptoClient.WrapKeyAsync(    KeyWrapAlgorithm.RsaOaep256,     keyToWrap);
// Unwrap keyUnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(    KeyWrapAlgorithm.RsaOaep256,     wrapResult.EncryptedKey);

// Data to signbyte[] data = Encoding.UTF8.GetBytes("Data to sign");
// Sign data (computes hash internally)SignResult signResult = await cryptoClient.SignDataAsync(    SignatureAlgorithm.RS256,     data);
// Verify signatureVerifyResult verifyResult = await cryptoClient.VerifyDataAsync(    SignatureAlgorithm.RS256,     data,     signResult.Signature);Console.WriteLine($"Signature valid: {verifyResult.IsValid}");
// Or sign pre-computed hashusing var sha256 = SHA256.Create();byte[] hash = sha256.ComputeHash(data);
SignResult signHashResult = await cryptoClient.SignAsync(    SignatureAlgorithm.RS256,     hash);

using Azure.Security.KeyVault.Keys.Cryptography;
var resolver = new KeyResolver(new DefaultAzureCredential());
// Resolve key by ID to get CryptographyClientCryptographyClient cryptoClient = await resolver.ResolveAsync(    new Uri("https://myvault.vault.azure.net/keys/my-key/version"));
// Use for encryptionEncryptResult result = await cryptoClient.EncryptAsync(    EncryptionAlgorithm.RsaOaep256,     plaintext);

// Rotate key (creates new version)KeyVaultKey rotatedKey = await client.RotateKeyAsync("my-rsa-key");Console.WriteLine($"New version: {rotatedKey.Properties.Version}");
// Get rotation policyKeyRotationPolicy policy = await client.GetKeyRotationPolicyAsync("my-rsa-key");
// Update rotation policypolicy.ExpiresIn = "P90D"; // 90 dayspolicy.LifetimeActions.Add(new KeyRotationLifetimeAction{    Action = KeyRotationPolicyAction.Rotate,    TimeBeforeExpiry = "P30D" // Rotate 30 days before expiry});
await client.UpdateKeyRotationPolicyAsync("my-rsa-key", policy);

using Azure;
try{    KeyVaultKey key = await client.GetKeyAsync("my-key");}catch (RequestFailedException ex) when (ex.Status == 404){    Console.WriteLine("Key not found");}catch (RequestFailedException ex) when (ex.Status == 403){    Console.WriteLine("Access denied - check RBAC permissions");}catch (RequestFailedException ex){    Console.WriteLine($"Key Vault error: {ex.Status} - {ex.Message}");}