# Azure Key Vault

lazysecrets reads Azure with your az CLI login: run `az login` once, and
it reuses it.

## Accounts

Every account signed in to az gets its own group in the Sources pane
(`az login` again with another account to add one), and each account's
vaults are read with that account. A subscription several accounts can see
is listed under each, since their permissions can differ.

A service principal is used instead when `AZURE_CLIENT_ID`,
`AZURE_TENANT_ID` and a secret or certificate are set in the environment.

If your az login expires mid-session, the status line says so: press `L` to
run `az login` without leaving lazysecrets, and everything reloads.

## Permissions

Vaults are discovered with Resource Graph, so you need read access to the
vault resources (e.g. *Reader*). Key Vault data-plane access is separate
(Azure RBAC or access policies). With RBAC, typically:

| To | Role |
|---|---|
| list secrets, keys and certificates | *Key Vault Reader* |
| read secret values | *Key Vault Secrets User* |
| read certificate details | *Key Vault Certificate User* |

A missing permission is shown in the pane, including the action that was
denied.

## Vaults you can't discover

A vault you can read but not see through Resource Graph can be pinned in
the [config](config.md); it's listed under "Pinned vaults" and read with
az's default account:

```yaml
providers:
  azure:
    vaults:
      - https://kv-foo.vault.azure.net/
    hideSubscriptions: [platform-mgmt] # by name or ID
```

## What's shown

Secrets, keys and certificates, each on their own tab of the Secrets pane
(`[`/`]`). `space` reveals a secret's value, or the public material of a
key (PEM public key) or certificate; private key material is never
fetched. `v` lists an item's versions. Items expiring within
`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.