Azure Security Keyvault Secrets Java

import com.azure.core.credential.TokenCredential;import com.azure.identity.AzureIdentityEnvVars;import com.azure.identity.DefaultAzureCredentialBuilder;import com.azure.identity.ManagedIdentityCredentialBuilder;import com.azure.security.keyvault.secrets.SecretClient;import com.azure.security.keyvault.secrets.SecretClientBuilder;
// Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>TokenCredential credential = new DefaultAzureCredentialBuilder()    .requireEnvVars(AzureIdentityEnvVars.AZURE_TOKEN_CREDENTIALS)    .build();// Or use a specific credential directly in production:// See https://learn.microsoft.com/java/api/overview/azure/identity-readme?view=azure-java-stable#credential-classes// TokenCredential credential = new ManagedIdentityCredentialBuilder().build();
// Sync clientSecretClient secretClient = new SecretClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildClient();
// Async clientSecretAsyncClient secretAsyncClient = new SecretClientBuilder()    .vaultUrl("https://<vault-name>.vault.azure.net")    .credential(credential)    .buildAsyncClient();

import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
// Simple secretKeyVaultSecret secret = secretClient.setSecret("database-password", "P@ssw0rd123!");System.out.println("Secret name: " + secret.getName());System.out.println("Secret ID: " + secret.getId());
// Secret with optionsKeyVaultSecret secretWithOptions = secretClient.setSecret(    new KeyVaultSecret("api-key", "sk_live_abc123xyz")        .setProperties(new SecretProperties()            .setContentType("application/json")            .setExpiresOn(OffsetDateTime.now().plusYears(1))            .setNotBefore(OffsetDateTime.now())            .setEnabled(true)            .setTags(Map.of(                "environment", "production",                "service", "payment-api"            ))        ));

// Get latest versionKeyVaultSecret secret = secretClient.getSecret("database-password");String value = secret.getValue();System.out.println("Secret value: " + value);
// Get specific versionKeyVaultSecret specificVersion = secretClient.getSecret("database-password", "<version-id>");
// Get only properties (no value)SecretProperties props = secretClient.getSecret("database-password").getProperties();System.out.println("Enabled: " + props.isEnabled());System.out.println("Created: " + props.getCreatedOn());

// Get secretKeyVaultSecret secret = secretClient.getSecret("api-key");
// Update properties (cannot update value - create new version instead)secret.getProperties()    .setEnabled(false)    .setExpiresOn(OffsetDateTime.now().plusMonths(6))    .setTags(Map.of("status", "rotating"));
SecretProperties updated = secretClient.updateSecretProperties(secret.getProperties());System.out.println("Updated: " + updated.getUpdatedOn());

import com.azure.core.util.paging.PagedIterable;import com.azure.security.keyvault.secrets.models.SecretProperties;
// List all secrets (properties only, no values)for (SecretProperties secretProps : secretClient.listPropertiesOfSecrets()) {    System.out.println("Secret: " + secretProps.getName());    System.out.println("  Enabled: " + secretProps.isEnabled());    System.out.println("  Created: " + secretProps.getCreatedOn());    System.out.println("  Content-Type: " + secretProps.getContentType());        // Get value if needed    if (secretProps.isEnabled()) {        KeyVaultSecret fullSecret = secretClient.getSecret(secretProps.getName());        System.out.println("  Value: " + fullSecret.getValue().substring(0, 5) + "...");    }}
// List versions of a secretfor (SecretProperties version : secretClient.listPropertiesOfSecretVersions("database-password")) {    System.out.println("Version: " + version.getVersion());    System.out.println("Created: " + version.getCreatedOn());    System.out.println("Enabled: " + version.isEnabled());}

import com.azure.core.util.polling.SyncPoller;import com.azure.security.keyvault.secrets.models.DeletedSecret;
// Begin delete (returns poller for soft-delete enabled vaults)SyncPoller<DeletedSecret, Void> deletePoller = secretClient.beginDeleteSecret("old-secret");
// Wait for deletionDeletedSecret deletedSecret = deletePoller.poll().getValue();System.out.println("Deleted on: " + deletedSecret.getDeletedOn());System.out.println("Scheduled purge: " + deletedSecret.getScheduledPurgeDate());
deletePoller.waitForCompletion();

// List deleted secretsfor (DeletedSecret deleted : secretClient.listDeletedSecrets()) {    System.out.println("Deleted: " + deleted.getName());    System.out.println("Deletion date: " + deleted.getDeletedOn());}
// Recover deleted secretSyncPoller<KeyVaultSecret, Void> recoverPoller = secretClient.beginRecoverDeletedSecret("old-secret");recoverPoller.waitForCompletion();
KeyVaultSecret recovered = recoverPoller.getFinalResult();System.out.println("Recovered: " + recovered.getName());

// Permanently delete (cannot be recovered)secretClient.purgeDeletedSecret("old-secret");
// Get deleted secret info firstDeletedSecret deleted = secretClient.getDeletedSecret("old-secret");System.out.println("Will purge: " + deleted.getName());secretClient.purgeDeletedSecret("old-secret");

// Backup secret (all versions)byte[] backup = secretClient.backupSecret("important-secret");
// Save to fileFiles.write(Paths.get("secret-backup.blob"), backup);
// Restore from backupbyte[] backupData = Files.readAllBytes(Paths.get("secret-backup.blob"));KeyVaultSecret restored = secretClient.restoreSecretBackup(backupData);System.out.println("Restored: " + restored.getName());

SecretAsyncClient asyncClient = new SecretClientBuilder()    .vaultUrl("https://<vault>.vault.azure.net")    .credential(new DefaultAzureCredentialBuilder().build())    .buildAsyncClient();
// Set secret asyncasyncClient.setSecret("async-secret", "async-value")    .subscribe(        secret -> System.out.println("Created: " + secret.getName()),        error -> System.out.println("Error: " + error.getMessage())    );
// Get secret asyncasyncClient.getSecret("async-secret")    .subscribe(secret -> System.out.println("Value: " + secret.getValue()));
// List secrets asyncasyncClient.listPropertiesOfSecrets()    .doOnNext(props -> System.out.println("Found: " + props.getName()))    .subscribe();

public class ConfigLoader {    private final SecretClient client;        public ConfigLoader(String vaultUrl) {        this.client = new SecretClientBuilder()            .vaultUrl(vaultUrl)            .credential(new DefaultAzureCredentialBuilder().build())            .buildClient();    }        public Map<String, String> loadSecrets(List<String> secretNames) {        Map<String, String> secrets = new HashMap<>();        for (String name : secretNames) {            try {                KeyVaultSecret secret = client.getSecret(name);                secrets.put(name, secret.getValue());            } catch (ResourceNotFoundException e) {                System.out.println("Secret not found: " + name);            }        }        return secrets;    }}
// UsageConfigLoader loader = new ConfigLoader("https://my-vault.vault.azure.net");Map<String, String> config = loader.loadSecrets(    Arrays.asList("db-connection-string", "api-key", "jwt-secret"));

public void rotateSecret(String secretName, String newValue) {    // Get current secret    KeyVaultSecret current = secretClient.getSecret(secretName);        // Disable old version    current.getProperties().setEnabled(false);    secretClient.updateSecretProperties(current.getProperties());        // Create new version with new value    KeyVaultSecret newSecret = secretClient.setSecret(secretName, newValue);    System.out.println("Rotated to version: " + newSecret.getProperties().getVersion());}

import com.azure.core.exception.HttpResponseException;import com.azure.core.exception.ResourceNotFoundException;
try {    KeyVaultSecret secret = secretClient.getSecret("my-secret");    System.out.println("Value: " + secret.getValue());} catch (ResourceNotFoundException e) {    System.out.println("Secret not found");} catch (HttpResponseException e) {    int status = e.getResponse().getStatusCode();    if (status == 403) {        System.out.println("Access denied - check permissions");    } else if (status == 429) {        System.out.println("Rate limited - retry later");    } else {        System.out.println("HTTP error: " + status);    }}

// Database connection stringsecretClient.setSecret(new KeyVaultSecret("db-connection",     "Server=myserver.database.windows.net;Database=mydb;...")    .setProperties(new SecretProperties()        .setContentType("text/plain")        .setTags(Map.of("type", "connection-string"))));
// API keysecretClient.setSecret(new KeyVaultSecret("stripe-api-key", "sk_live_...")    .setProperties(new SecretProperties()        .setContentType("text/plain")        .setExpiresOn(OffsetDateTime.now().plusYears(1))));
// JSON configurationsecretClient.setSecret(new KeyVaultSecret("app-config",     "{\"endpoint\":\"https://...\",\"key\":\"...\"}")    .setProperties(new SecretProperties()        .setContentType("application/json")));
// Certificate passwordsecretClient.setSecret(new KeyVaultSecret("cert-password", "CertP@ss!")    .setProperties(new SecretProperties()        .setContentType("text/plain")        .setTags(Map.of("certificate", "my-cert"))));