keys

Creates, updates, deletes, gets or lists a keys resource.

Overview

Name	keys
Type	Resource
Id	azure.key_vault.keys

Fields

The following fields are returned by SELECT queries:

get_version

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
attributes	object	The attributes of the key.
curveName	string	The elliptic curve name. For valid values, see JsonWebKeyCurveName. Default for EC and EC-HSM keys is P-256. Known values are: "P-256", "P-384", "P-521", and "P-256K". (P-256, P-384, P-521, P-256K)
keyOps	array	:vartype key_ops: list[str or ~azure.mgmt.keyvault.models.JsonWebKeyOperation]
keySize	integer	The key size in bits. For example: 2048, 3072, or 4096 for RSA. Default for RSA and RSA-HSM keys is 2048. Exception made for bring your own key (BYOK), key exchange keys default to 4096.
keyUri	string	The URI to retrieve the current version of the key.
keyUriWithVersion	string	The URI to retrieve the specific version of the key.
kty	string	The type of the key. For valid values, see JsonWebKeyType. Known values are: "EC", "EC-HSM", "RSA", and "RSA-HSM". (EC, EC-HSM, RSA, RSA-HSM)
location	string	The supported Azure location where the managed HSM Pool should be created.
release_policy	object	Key release policy in response. It will be used for both output and input. Omitted if empty.
rotationPolicy	object	Key rotation policy in response. It will be used for both output and input. Omitted if empty.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
attributes	object	The attributes of the key.
curveName	string	The elliptic curve name. For valid values, see JsonWebKeyCurveName. Default for EC and EC-HSM keys is P-256. Known values are: "P-256", "P-384", "P-521", and "P-256K". (P-256, P-384, P-521, P-256K)
keyOps	array	:vartype key_ops: list[str or ~azure.mgmt.keyvault.models.JsonWebKeyOperation]
keySize	integer	The key size in bits. For example: 2048, 3072, or 4096 for RSA. Default for RSA and RSA-HSM keys is 2048. Exception made for bring your own key (BYOK), key exchange keys default to 4096.
keyUri	string	The URI to retrieve the current version of the key.
keyUriWithVersion	string	The URI to retrieve the specific version of the key.
kty	string	The type of the key. For valid values, see JsonWebKeyType. Known values are: "EC", "EC-HSM", "RSA", and "RSA-HSM". (EC, EC-HSM, RSA, RSA-HSM)
location	string	The supported Azure location where the managed HSM Pool should be created.
release_policy	object	Key release policy in response. It will be used for both output and input. Omitted if empty.
rotationPolicy	object	Key rotation policy in response. It will be used for both output and input. Omitted if empty.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
attributes	object	The attributes of the key.
curveName	string	The elliptic curve name. For valid values, see JsonWebKeyCurveName. Default for EC and EC-HSM keys is P-256. Known values are: "P-256", "P-384", "P-521", and "P-256K". (P-256, P-384, P-521, P-256K)
keyOps	array	:vartype key_ops: list[str or ~azure.mgmt.keyvault.models.JsonWebKeyOperation]
keySize	integer	The key size in bits. For example: 2048, 3072, or 4096 for RSA. Default for RSA and RSA-HSM keys is 2048. Exception made for bring your own key (BYOK), key exchange keys default to 4096.
keyUri	string	The URI to retrieve the current version of the key.
keyUriWithVersion	string	The URI to retrieve the specific version of the key.
kty	string	The type of the key. For valid values, see JsonWebKeyType. Known values are: "EC", "EC-HSM", "RSA", and "RSA-HSM". (EC, EC-HSM, RSA, RSA-HSM)
location	string	The supported Azure location where the managed HSM Pool should be created.
release_policy	object	Key release policy in response. It will be used for both output and input. Omitted if empty.
rotationPolicy	object	Key rotation policy in response. It will be used for both output and input. Omitted if empty.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_version	select	resource_group_name, vault_name, key_name, key_version, subscription_id		Gets the specified version of the specified key in the specified key vault.
get	select	resource_group_name, vault_name, key_name, subscription_id		Gets the current version of the specified key from the specified key vault.
list	select	resource_group_name, vault_name, subscription_id		Lists the keys in the specified key vault.
create_if_not_exist	exec	resource_group_name, vault_name, key_name, subscription_id, properties		Creates the first version of a new key if it does not exist. If it already exists, then the existing key is returned without any write operations being performed. This API does not create subsequent versions, and does not update existing keys.
list_versions	exec	resource_group_name, vault_name, key_name, subscription_id		Lists the keys in the specified key vault.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
key_name	string	The name of the key version to be retrieved. Required.
key_version	string	The version of the key to be retrieved. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
vault_name	string	The name of the vault which contains the key version to be retrieved. Required.

SELECT examples

get_version

Gets the specified version of the specified key in the specified key vault.

SELECT
id,
name,
attributes,
curveName,
keyOps,
keySize,
keyUri,
keyUriWithVersion,
kty,
location,
release_policy,
rotationPolicy,
systemData,
tags,
type
FROM azure.key_vault.keys
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND vault_name = '{{ vault_name }}' -- required
AND key_name = '{{ key_name }}' -- required
AND key_version = '{{ key_version }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

get

Gets the current version of the specified key from the specified key vault.

SELECT
id,
name,
attributes,
curveName,
keyOps,
keySize,
keyUri,
keyUriWithVersion,
kty,
location,
release_policy,
rotationPolicy,
systemData,
tags,
type
FROM azure.key_vault.keys
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND vault_name = '{{ vault_name }}' -- required
AND key_name = '{{ key_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Lists the keys in the specified key vault.

SELECT
id,
name,
attributes,
curveName,
keyOps,
keySize,
keyUri,
keyUriWithVersion,
kty,
location,
release_policy,
rotationPolicy,
systemData,
tags,
type
FROM azure.key_vault.keys
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND vault_name = '{{ vault_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

Lifecycle Methods

create_if_not_exist

Creates the first version of a new key if it does not exist. If it already exists, then the existing key is returned without any write operations being performed. This API does not create subsequent versions, and does not update existing keys.

EXEC azure.key_vault.keys.create_if_not_exist 
@resource_group_name='{{ resource_group_name }}' --required, 
@vault_name='{{ vault_name }}' --required, 
@key_name='{{ key_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"tags": "{{ tags }}", 
"properties": "{{ properties }}"
}'
;

list_versions

Lists the keys in the specified key vault.

EXEC azure.key_vault.keys.list_versions 
@resource_group_name='{{ resource_group_name }}' --required, 
@vault_name='{{ vault_name }}' --required, 
@key_name='{{ key_name }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;