Azure Keyvault Keys Rust

作者 microsoft354361d83247MIT收录于 2026年10月8日更新于 2026年10月8日

Azure Key Vault Keys library for Rust. Create, manage, and use cryptographic keys including RSA, EC, and HSM-protected keys. Triggers: "keyvault keys rust", "KeyClient rust", "create key rust", "encrypt rust", "wrap key rust", "sign rust".

精选仅含说明Software Development Security

AI 生成的概览

指导 Rust 开发者使用 Azure Key Vault Keys 库创建、管理和使用加密密钥。

功能: 该技能提供在 Rust 中使用 Azure Key Vault Keys 库的说明和代码示例。涵盖创建、更新、删除和列出密钥，以及包装和解包数据加密密钥、签名和验证数据。还记录了密钥类型、RBAC 角色、身份验证设置以及依赖管理和客户端重用的最佳实践。
适用场景: 当构建需要在 Azure Key Vault 中创建或管理加密密钥、执行信封加密或使用 HSM 保护密钥的 Rust 应用程序时使用此技能。当需要从 Rust 使用 Key Vault 密钥对数据进行签名或验证时也适用。
运行要求: 需要 Rust 工具链以及 azure_security_keyvault_keys、azure_identity、tokio 和 futures 这些 crate。需要通过 AZURE_KEYVAULT_URL 环境变量设置 Azure Key Vault URL，并具备适当的凭据（本地开发使用 DeveloperToolsCredential，生产环境使用 ManagedIdentityCredential）。需要访问 Azure Key Vault 的网络连接。不附带脚本，仅为说明文档。

Azure Key Vault Keys library for Rust

Secure storage and management of cryptographic keys — RSA, EC, and HSM-protected.

Use this skill when:

An app needs to create or manage cryptographic keys in Key Vault from Rust
You need to wrap/unwrap data encryption keys (envelope encryption)
You need to sign or verify data with Key Vault keys
You need HSM-protected keys

IMPORTANT: Only use the official azure_security_keyvault_keys crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_keys re-exports, direct azure_core dependency is optional.

Environment Variables

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

rust

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_keys::KeyClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = KeyClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let key = client.get_key("key-name", None).await?.into_model()?;    println!("Key: {:?}", key.key);    Ok(())}

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_keys::KeyClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = KeyClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let key = client.get_key("key-name", None).await?.into_model()?;    println!("Key: {:?}", key.key);    Ok(())}

Prefer the crate README/examples when checking public operation shapes such as key creation, wrapping, and version-aware unwrap flows.

Core Workflow

Create Key

rust

use azure_security_keyvault_keys::{    models::{CreateKeyParameters, CurveName, KeyType},    ResourceExt,};
// Create an EC keylet body = CreateKeyParameters {    kty: Some(KeyType::Ec),    curve: Some(CurveName::P256),    ..Default::default()};
let key = client    .create_key("key-name", body.try_into()?, None)    .await?    .into_model()?;
println!(    "Name: {:?}, Type: {:?}, Version: {:?}",    key.resource_id()?.name,    key.key.as_ref().map(|k| k.kty.as_ref()),    key.resource_id()?.version,);

use azure_security_keyvault_keys::{    models::{CreateKeyParameters, CurveName, KeyType},    ResourceExt,};
// Create an EC keylet body = CreateKeyParameters {    kty: Some(KeyType::Ec),    curve: Some(CurveName::P256),    ..Default::default()};
let key = client    .create_key("key-name", body.try_into()?, None)    .await?    .into_model()?;
println!(    "Name: {:?}, Type: {:?}, Version: {:?}",    key.resource_id()?.name,    key.key.as_ref().map(|k| k.kty.as_ref()),    key.resource_id()?.version,);

Update Key Properties

rust

use azure_security_keyvault_keys::models::UpdateKeyPropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateKeyPropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_key_properties("key-name", params.try_into()?, None)    .await?    .into_model()?;

use azure_security_keyvault_keys::models::UpdateKeyPropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateKeyPropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_key_properties("key-name", params.try_into()?, None)    .await?    .into_model()?;

Delete Key

List Keys (Pagination)

list_key_properties returns a Pager<T> — iterate items directly:

rust

use azure_security_keyvault_keys::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_key_properties(None)?;while let Some(key) = pager.try_next().await? {    println!("Found: {}", key.resource_id()?.name);}

use azure_security_keyvault_keys::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_key_properties(None)?;while let Some(key) = pager.try_next().await? {    println!("Found: {}", key.resource_id()?.name);}

Wrap / Unwrap (Envelope Encryption)

Key Vault performs crypto operations server-side — the private key never leaves the HSM:

rust

use azure_security_keyvault_keys::{    models::{        CreateKeyParameters, EncryptionAlgorithm, KeyOperationParameters, KeyType,    },    ResourceExt, ResourceId,};use rand::random;
// Create a key encryption key (KEK)let body = CreateKeyParameters {    kty: Some(KeyType::Rsa),    key_size: Some(2048),    ..Default::default()};
let key = client    .create_key("kek-name", body.try_into()?, None)    .await?    .into_model()?;
// Generate a symmetric data encryption key (DEK)let dek = random::<u32>().to_le_bytes().to_vec();
// Wrap the DEK with the KEKlet mut params = KeyOperationParameters {    algorithm: Some(EncryptionAlgorithm::RsaOaep256),    value: Some(dek.clone()),    ..Default::default()};let wrapped = client    .wrap_key("kek-name", params.clone().try_into()?, None)    .await?    .into_model()?;
// Retain the key version used to wrap so you can unwrap with the same version laterlet ResourceId { version, .. } = wrapped.resource_id()?;let key_version = version.as_deref().unwrap_or_default();
// Unwrap to recover the DEKparams.value = wrapped.result;let unwrapped = client    .unwrap_key("kek-name", key_version, params.try_into()?, None)    .await?    .into_model()?;
assert!(matches!(unwrapped.result, Some(ref result) if result.eq(&dek)));

use azure_security_keyvault_keys::{    models::{        CreateKeyParameters, EncryptionAlgorithm, KeyOperationParameters, KeyType,    },    ResourceExt, ResourceId,};use rand::random;
// Create a key encryption key (KEK)let body = CreateKeyParameters {    kty: Some(KeyType::Rsa),    key_size: Some(2048),    ..Default::default()};
let key = client    .create_key("kek-name", body.try_into()?, None)    .await?    .into_model()?;
// Generate a symmetric data encryption key (DEK)let dek = random::<u32>().to_le_bytes().to_vec();
// Wrap the DEK with the KEKlet mut params = KeyOperationParameters {    algorithm: Some(EncryptionAlgorithm::RsaOaep256),    value: Some(dek.clone()),    ..Default::default()};let wrapped = client    .wrap_key("kek-name", params.clone().try_into()?, None)    .await?    .into_model()?;
// Retain the key version used to wrap so you can unwrap with the same version laterlet ResourceId { version, .. } = wrapped.resource_id()?;let key_version = version.as_deref().unwrap_or_default();
// Unwrap to recover the DEKparams.value = wrapped.result;let unwrapped = client    .unwrap_key("kek-name", key_version, params.try_into()?, None)    .await?    .into_model()?;
assert!(matches!(unwrapped.result, Some(ref result) if result.eq(&dek)));

Key Types

Type	Use Case	Parameter
EC	Signing, key agreement	`KeyType::Ec`
RSA	Encryption, signing, wrapping	`KeyType::Rsa`
Oct	Symmetric operations (HSM)	`KeyType::Oct`
EC-HSM	HSM-protected EC keys	`KeyType::EcHsm`
RSA-HSM	HSM-protected RSA keys	`KeyType::RsaHsm`

RBAC Roles

For Entra ID auth, assign one of these roles:

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract key name/version from key IDs
Reuse clients — KeyClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_keys/latest/azure_security_keyvault_keys
crates.io	https://crates.io/crates/azure_security_keyvault_keys
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_keys

来源与署名

来源：microsoft/skills位于.github/plugins/azure-sdk-rust/skills/azure-keyvault-keys-rust提交354361d

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Role	Access
`Key Vault Crypto User`	Use keys for crypto ops
`Key Vault Crypto Officer`	Full key management

Azure Keyvault Keys Rust

Azure Key Vault Keys library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Key

Update Key Properties

Delete Key

List Keys (Pagination)

Wrap / Unwrap (Envelope Encryption)

Key Types

RBAC Roles

Best Practices

Reference Links

来源与署名

更多来自 microsoft/skills 的技能

Customize

Discover Azure Skills

Azure Resource Visualizer

Azure Resource Lookup

Azure Messaging

Azure Kusto

更多Software Development技能

Playground

M5 Onboard

Cardputer Buddy

Testing Strategy

Tech Debt

System Design