kebandClaude Opus 5.5
6fab41703e
Release / Build and publish (push) Successful in 22s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
55 lines
1.8 KiB
Markdown
55 lines
1.8 KiB
Markdown
# Azure Key Vault
|
|
|
|
lazysecrets reads Azure with your az CLI login: run `az login` once, and
|
|
it reuses it.
|
|
|
|
## Accounts
|
|
|
|
Every account signed in to az gets its own group in the Sources pane
|
|
(`az login` again with another account to add one), and each account's
|
|
vaults are read with that account. A subscription several accounts can see
|
|
is listed under each, since their permissions can differ.
|
|
|
|
A service principal is used instead when `AZURE_CLIENT_ID`,
|
|
`AZURE_TENANT_ID` and a secret or certificate are set in the environment.
|
|
|
|
If your az login expires mid-session, the status line says so: press `L` to
|
|
run `az login` without leaving lazysecrets, and everything reloads.
|
|
|
|
## Permissions
|
|
|
|
Vaults are discovered with Resource Graph, so you need read access to the
|
|
vault resources (e.g. *Reader*). Key Vault data-plane access is separate
|
|
(Azure RBAC or access policies). With RBAC, typically:
|
|
|
|
| To | Role |
|
|
|---|---|
|
|
| list secrets, keys and certificates | *Key Vault Reader* |
|
|
| read secret values | *Key Vault Secrets User* |
|
|
| read certificate details | *Key Vault Certificate User* |
|
|
|
|
A missing permission is shown in the pane, including the action that was
|
|
denied.
|
|
|
|
## Vaults you can't discover
|
|
|
|
A vault you can read but not see through Resource Graph can be pinned in
|
|
the [config](config.md); it's listed under "Pinned vaults" and read with
|
|
az's default account:
|
|
|
|
```yaml
|
|
providers:
|
|
azure:
|
|
vaults:
|
|
- https://kv-foo.vault.azure.net/
|
|
hideSubscriptions: [platform-mgmt] # by name or ID
|
|
```
|
|
|
|
## What's shown
|
|
|
|
Secrets, keys and certificates, each on their own tab of the Secrets pane
|
|
(`[`/`]`). `space` reveals a secret's value, or the public material of a
|
|
key (PEM public key) or certificate; private key material is never
|
|
fetched. `v` lists an item's versions. Items expiring within
|
|
`expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
|