AzureKeyVaultProvider

Azure Key Vault secret provider.

class scamander.secrets.azure_keyvault.AzureKeyVaultProvider(default_vault: str | None = None, credential: object | None = None)

Bases: SecretProvider

Retrieve secrets from Azure Key Vault using azure-identity for auth.

Authentication is handled by azure.identity.DefaultAzureCredential, which tries the following in order: environment variables (AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID), workload identity (AKS), managed identity, Azure CLI, and VS Code credentials. No explicit credential management is required in most hosted environments.

A custom credential can be supplied via the credential parameter to override this default — useful when the token must be sourced externally, e.g. from Databricks Service Credentials or another identity provider. Any object satisfying the azure.core.credentials.TokenCredential protocol is accepted.

Parameters:

  • default_vault – Default Key Vault name used when vault is not passed to get_secret(). The HTTPS vault URL is built automatically as https://<vault>.vault.azure.net/.

  • credential – Optional Azure credential. When supplied, used directly instead of constructing a DefaultAzureCredential.

Example:

provider = AzureKeyVaultProvider(default_vault="my-keyvault")
password = provider.get_secret("pg-password")

# Use a different vault per-call:
token = provider.get_secret("api-token", vault="other-keyvault")
get_secret(secret_name: str, vault: str | None = None) → str

Retrieve a secret from Azure Key Vault.

Parameters:

  • secret_name – Name of the secret in Key Vault.

  • vault – Key Vault name (e.g. "my-keyvault"). The vault URL is constructed as https://<vault>.vault.azure.net/. Overrides default_vault set in the constructor.

Returns:

The latest enabled version of the secret as a plain string.

Raises:

  • ImportError – When azure-identity or azure-keyvault-secrets are not installed.

  • ValueError – When no vault name is available from the call or the constructor.