vaults

Creates, updates, deletes, gets or lists a vaults resource.

Overview

Name	vaults
Type	Resource
Id	azure.key_vault.vaults

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
accessPolicies	array	An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required.
createMode	string	The vault's create mode to indicate whether the vault need to be recovered or not. Known values are: "recover" and "default". (recover, default)
enablePurgeProtection	boolean	Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization	boolean	Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete	boolean	Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment	boolean	Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption	boolean	Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment	boolean	Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
hsmPoolResourceId	string	The resource id of HSM Pool.
location	string	Azure location of the key vault resource.
networkAcls	object	Rules governing the accessibility of the key vault from specific network locations.
privateEndpointConnections	array	List of private endpoint connections associated with the key vault.
provisioningState	string	Provisioning state of the vault. Known values are: "Succeeded" and "RegisteringDns". (Succeeded, RegisteringDns)
publicNetworkAccess	string	Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
sku	object	SKU details. Required.
softDeleteRetentionInDays	integer	softDelete data retention days. It accepts >=7 and <=90.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Tags assigned to the key vault resource.
tenantId	string	The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vaultUri	string	The URI of the vault for performing operations on keys and secrets.

get_deleted

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
deletionDate	string (date-time)	The deleted date.
location	string	The location of the original vault.
purgeProtectionEnabled	boolean	Purge protection status of the original vault.
scheduledPurgeDate	string (date-time)	The scheduled purged date.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Tags of the original vault.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vaultId	string	The resource id of the original vault.

check_name_availability

Name	Datatype	Description
message	string	An error message explaining the Reason value in more detail.
nameAvailable	boolean	A boolean value that indicates whether the name is available for you to use. If true, the name is available. If false, the name has already been taken or is invalid and cannot be used.
reason	string	The reason that a vault name could not be used. The Reason element is only returned if NameAvailable is false. Known values are: "AccountNameInvalid" and "AlreadyExists". (AccountNameInvalid, AlreadyExists)

list_by_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
accessPolicies	array	An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When createMode is set to recover, access policies are not required. Otherwise, access policies are required.
createMode	string	The vault's create mode to indicate whether the vault need to be recovered or not. Known values are: "recover" and "default". (recover, default)
enablePurgeProtection	boolean	Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization	boolean	Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete	boolean	Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
enabledForDeployment	boolean	Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption	boolean	Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment	boolean	Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
hsmPoolResourceId	string	The resource id of HSM Pool.
location	string	Azure location of the key vault resource.
networkAcls	object	Rules governing the accessibility of the key vault from specific network locations.
privateEndpointConnections	array	List of private endpoint connections associated with the key vault.
provisioningState	string	Provisioning state of the vault. Known values are: "Succeeded" and "RegisteringDns". (Succeeded, RegisteringDns)
publicNetworkAccess	string	Property to specify whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
sku	object	SKU details. Required.
softDeleteRetentionInDays	integer	softDelete data retention days. It accepts >=7 and <=90.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Tags assigned to the key vault resource.
tenantId	string	The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Required.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
vaultUri	string	The URI of the vault for performing operations on keys and secrets.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
location	string	The geo-location where the resource lives. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, vault_name, subscription_id		Gets the specified Azure key vault.
get_deleted	select	vault_name, location, subscription_id		Gets the deleted Azure key vault.
check_name_availability	select	subscription_id		Checks that the vault name is valid and is not already in use.
list_by_resource_group	select	resource_group_name, subscription_id	$top	The List operation gets information about the vaults associated with the subscription and within the specified resource group.
list	select	subscription_id	$top	The List operation gets information about the vaults associated with the subscription.
create_or_update	insert	resource_group_name, vault_name, subscription_id, location, properties		Create or update a key vault in the specified subscription.
update	update	resource_group_name, vault_name, subscription_id		Update a key vault in the specified subscription.
create_or_update	replace	resource_group_name, vault_name, subscription_id, location, properties		Create or update a key vault in the specified subscription.
delete	delete	resource_group_name, vault_name, subscription_id		Deletes the specified Azure key vault.
list_by_subscription	exec	subscription_id	$top	The List operation gets information about the vaults associated with the subscription.
list_deleted	exec	subscription_id		Gets information about the deleted vaults in a subscription.
update_access_policy	exec	resource_group_name, vault_name, operation_kind, subscription_id, properties		Update access policies in a key vault in the specified subscription.
purge_deleted	exec	vault_name, location, subscription_id		Permanently deletes the specified vault. aka Purges the deleted Azure key vault.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
location	string	The name of the Azure region. Required.
operation_kind	string	Name of the operation. Known values are: "add", "replace", and "remove". Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
vault_name	string	The name of the vault. Required.
$top	integer	Maximum number of results to return. Default value is None.

SELECT examples

get

Gets the specified Azure key vault.

SELECT
id,
name,
accessPolicies,
createMode,
enablePurgeProtection,
enableRbacAuthorization,
enableSoftDelete,
enabledForDeployment,
enabledForDiskEncryption,
enabledForTemplateDeployment,
hsmPoolResourceId,
location,
networkAcls,
privateEndpointConnections,
provisioningState,
publicNetworkAccess,
sku,
softDeleteRetentionInDays,
systemData,
tags,
tenantId,
type,
vaultUri
FROM azure.key_vault.vaults
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND vault_name = '{{ vault_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

get_deleted

Gets the deleted Azure key vault.

SELECT
id,
name,
deletionDate,
location,
purgeProtectionEnabled,
scheduledPurgeDate,
systemData,
tags,
type,
vaultId
FROM azure.key_vault.vaults
WHERE vault_name = '{{ vault_name }}' -- required
AND location = '{{ location }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

check_name_availability

Checks that the vault name is valid and is not already in use.

SELECT
message,
nameAvailable,
reason
FROM azure.key_vault.vaults
WHERE subscription_id = '{{ subscription_id }}' -- required
;

list_by_resource_group

The List operation gets information about the vaults associated with the subscription and within the specified resource group.

SELECT
id,
name,
accessPolicies,
createMode,
enablePurgeProtection,
enableRbacAuthorization,
enableSoftDelete,
enabledForDeployment,
enabledForDiskEncryption,
enabledForTemplateDeployment,
hsmPoolResourceId,
location,
networkAcls,
privateEndpointConnections,
provisioningState,
publicNetworkAccess,
sku,
softDeleteRetentionInDays,
systemData,
tags,
tenantId,
type,
vaultUri
FROM azure.key_vault.vaults
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $top = '{{ $top }}'
;

list

The List operation gets information about the vaults associated with the subscription.

SELECT
id,
name,
location,
systemData,
tags,
type
FROM azure.key_vault.vaults
WHERE subscription_id = '{{ subscription_id }}' -- required
AND $top = '{{ $top }}'
;

INSERT examples

create_or_update

Create or update a key vault in the specified subscription.

INSERT INTO azure.key_vault.vaults (
location,
tags,
properties,
resource_group_name,
vault_name,
subscription_id
)
SELECT 
'{{ location }}' /* required */,
'{{ tags }}',
'{{ properties }}' /* required */,
'{{ resource_group_name }}',
'{{ vault_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
location,
properties,
systemData,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: vaults
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the vaults resource.
  - name: vault_name
    value: "{{ vault_name }}"
    description: Required parameter for the vaults resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the vaults resource.
  - name: location
    value: "{{ location }}"
    description: |
      The supported Azure location where the key vault should be created. Required.
  - name: tags
    value: "{{ tags }}"
    description: |
      The tags that will be assigned to the key vault.
  - name: properties
    description: |
      Properties of the vault. Required.
    value:
      tenantId: "{{ tenantId }}"
      sku:
        family: "{{ family }}"
        name: "{{ name }}"
      accessPolicies:
        - tenantId: "{{ tenantId }}"
          objectId: "{{ objectId }}"
          applicationId: "{{ applicationId }}"
          permissions:
            keys:
              - "{{ keys }}"
            secrets:
              - "{{ secrets }}"
            certificates:
              - "{{ certificates }}"
            storage:
              - "{{ storage }}"
      vaultUri: "{{ vaultUri }}"
      hsmPoolResourceId: "{{ hsmPoolResourceId }}"
      enabledForDeployment: {{ enabledForDeployment }}
      enabledForDiskEncryption: {{ enabledForDiskEncryption }}
      enabledForTemplateDeployment: {{ enabledForTemplateDeployment }}
      enableSoftDelete: {{ enableSoftDelete }}
      softDeleteRetentionInDays: {{ softDeleteRetentionInDays }}
      enableRbacAuthorization: {{ enableRbacAuthorization }}
      createMode: "{{ createMode }}"
      enablePurgeProtection: {{ enablePurgeProtection }}
      networkAcls:
        bypass: "{{ bypass }}"
        defaultAction: "{{ defaultAction }}"
        ipRules:
          - value: "{{ value }}"
        virtualNetworkRules:
          - id: "{{ id }}"
            ignoreMissingVnetServiceEndpoint: {{ ignoreMissingVnetServiceEndpoint }}
      provisioningState: "{{ provisioningState }}"
      privateEndpointConnections:
        - id: "{{ id }}"
          etag: "{{ etag }}"
          properties:
            privateEndpoint:
              id: "{{ id }}"
            privateLinkServiceConnectionState:
              status: "{{ status }}"
              description: "{{ description }}"
              actionsRequired: "{{ actionsRequired }}"
            provisioningState: "{{ provisioningState }}"
      publicNetworkAccess: "{{ publicNetworkAccess }}"

UPDATE examples

update

Update a key vault in the specified subscription.

UPDATE azure.key_vault.vaults
SET 
tags = '{{ tags }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND vault_name = '{{ vault_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
location,
properties,
systemData,
tags,
type;

REPLACE examples

create_or_update

Create or update a key vault in the specified subscription.

REPLACE azure.key_vault.vaults
SET 
location = '{{ location }}',
tags = '{{ tags }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND vault_name = '{{ vault_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
AND location = '{{ location }}' --required
AND properties = '{{ properties }}' --required
RETURNING
id,
name,
location,
properties,
systemData,
tags,
type;

DELETE examples

delete

Deletes the specified Azure key vault.

DELETE FROM azure.key_vault.vaults
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND vault_name = '{{ vault_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;

Lifecycle Methods

list_by_subscription

The List operation gets information about the vaults associated with the subscription.

EXEC azure.key_vault.vaults.list_by_subscription 
@subscription_id='{{ subscription_id }}' --required, 
@$top='{{ $top }}'
;

list_deleted

Gets information about the deleted vaults in a subscription.

EXEC azure.key_vault.vaults.list_deleted 
@subscription_id='{{ subscription_id }}' --required
;

update_access_policy

Update access policies in a key vault in the specified subscription.

EXEC azure.key_vault.vaults.update_access_policy 
@resource_group_name='{{ resource_group_name }}' --required, 
@vault_name='{{ vault_name }}' --required, 
@operation_kind='{{ operation_kind }}' --required, 
@subscription_id='{{ subscription_id }}' --required 
@@json=
'{
"properties": "{{ properties }}"
}'
;

purge_deleted

Permanently deletes the specified vault. aka Purges the deleted Azure key vault.

EXEC azure.key_vault.vaults.purge_deleted 
@vault_name='{{ vault_name }}' --required, 
@location='{{ location }}' --required, 
@subscription_id='{{ subscription_id }}' --required
;