Azure Key Vault

Configure Azure authentication, vault access, and a test secret for Azure Key Vault.

Azure setup

Everything you need to use Envilder with Azure Key Vault.

1. Authenticate with Azure

Envilder uses Azure Default Credentials. Log in with:

az login

Provide the vault URL via $config in your map file or the --vault-url CLI flag.

2. Configure vault access

Check which access model your vault uses:

az keyvault show --name {VAULT_NAME}   --query properties.enableRbacAuthorization

true → Azure RBAC (recommended)
false / null → Vault Access Policy (classic)

Option A: Azure RBAC (recommended)

az role assignment create   --role "Key Vault Secrets Officer"   --assignee {YOUR_OBJECT_ID}   --scope /subscriptions/{SUB}/resourceGroups/{RG}/providers/Microsoft.KeyVault/vaults/{VAULT}

Option B: Vault Access Policy

az keyvault set-policy   --name {VAULT_NAME}   --object-id {YOUR_OBJECT_ID}   --secret-permissions get set list

3. Required permissions

Operation	Permission
Pull	Get
Push	Set

For pull-only access, Key Vault Secrets User role is sufficient.

4. Create a test secret and verify

Create a secret in Key Vault, then pull it with Envilder to confirm everything works:

# 1. Create a test secret
az keyvault secret set --vault-name {VAULT_NAME} --name "test-hello" --value "world"

# 2. Create a minimal map file
echo '{ "$config": { "provider": "azure", "vaultUrl": "https://{VAULT_NAME}.vault.azure.net" }, "HELLO": "test-hello" }' > test-map.json

# 3. Pull with Envilder
envilder --map=test-map.json --envfile=.env

If you see ✔ Fetched, your Azure setup is complete.

Or load secrets directly from your app with the Python SDK:

from envilder import Envilder

secrets = Envilder.load("test-map.json")
print(secrets["HELLO"])  # world