# Azure Key Vault component

> The `azure-key-vault` component manages secrets, keys and certificates in Azure Key Vault and signs, verifies, encrypts and decrypts with vault keys; the `{{azure:...}}` placeholder puts secrets into routes.

**Scheme:** `azure-key-vault:` · **Crate:** `cameleer-cloud` · **Cargo feature:** [`cloud`](../guides/build-features.md) · **Consumer:** no · **Producer:** yes ·
**Apache Camel:** [Azure Key Vault](https://camel.apache.org/components/next/azure-key-vault-component.html)

## When to use it

- Keep passwords and API keys out of route files: reference them as `{{azure:name}}`.
- Store credentials generated by a route as secrets.
- Sign or encrypt data with keys that never leave the vault (HSM-backed keys included).
- Restart routes automatically when a secret gets a new version (secret refresh).

## URI format

```text
azure-key-vault://vaultName[?options]
```

## Example

Store a partner token as a secret, authenticated with a service principal:

<!-- example: azure-key-vault-create-secret -->
```yaml
- route:
    id: store-partner-token
    from:
      uri: "timer:store-token?repeatCount=1"
      steps:
        - setHeader:
            name: CamelAzureKeyVaultSecretName
            constant: partner-api-token
        - setBody:
            constant: "{{env:PARTNER_TOKEN:}}"
        - to: "azure-key-vault://{{env:AZURE_KEY_VAULT_NAME:my-vault}}?operation=createSecret&tenantId={{env:AZURE_TENANT_ID:}}&clientId={{env:AZURE_CLIENT_ID:}}&clientSecret=RAW({{env:AZURE_CLIENT_SECRET:}})"
        - log: "stored ${body} (version ${header.CamelAzureKeyVaultSecretVersion})"
```

Use a secret with the `{{azure:...}}` placeholder; it is resolved when the route starts:

<!-- example: azure-key-vault-placeholder -->
```yaml
- route:
    id: call-partner-api
    from:
      uri: "timer:partner-sync?repeatCount=1"
      steps:
        - setHeader:
            name: Authorization
            constant: "Bearer {{azure:partner-api-token}}"
        - to: "log:partner-api"
```

The placeholder is configured with properties, for example in `application.properties`:

```properties
camel.vault.azure.vaultName=my-vault
camel.vault.azure.tenantId=00000000-0000-0000-0000-000000000000
camel.vault.azure.clientId=11111111-1111-1111-1111-111111111111
camel.vault.azure.clientSecret=change-me
# or, for managed identities and AZURE_* environment variables:
# camel.vault.azure.azureIdentityEnabled=true
```

## Rust DSL

```rust
ctx.add_routes(|b| {
    b.from("timer:store-token?repeatCount=1")
        .set_header("CamelAzureKeyVaultSecretName", constant("partner-api-token"))
        .set_body(constant("{{env:PARTNER_TOKEN:}}"))
        .to("azure-key-vault://{{env:AZURE_KEY_VAULT_NAME:my-vault}}?operation=createSecret&tenantId={{env:AZURE_TENANT_ID:}}&clientId={{env:AZURE_CLIENT_ID:}}&clientSecret=RAW({{env:AZURE_CLIENT_SECRET:}})")
        .log("stored ${body} (version ${header.CamelAzureKeyVaultSecretVersion})");
})?;
```

## Options

| option | default | description |
|---|---|---|
| `operation` | `getSecret` | Secrets: `createSecret`, `getSecret`, `deleteSecret`, `purgeDeletedSecret`, `recoverDeletedSecret`, `listSecrets`. Keys (Cameleer): `createKey`, `importKey`, `getKey`, `listKeys`, `deleteKey`, `signData`, `verifyData`, `encrypt`, `decrypt`, `wrapKey`, `unwrapKey`. Certificates (Cameleer): `createCertificate`, `getCertificate`, `importCertificate`, `listCertificates`, `deleteCertificate`. |
| `credentialType` | `CLIENT_SECRET` | `CLIENT_SECRET` (`tenantId`, `clientId`, `clientSecret`) or `AZURE_IDENTITY` (environment client secret, workload identity or managed identity). |
| `tenantId`, `clientId`, `clientSecret` | | Service principal. |
| `authorityHost` | `https://login.microsoftonline.com` | Entra ID host (sovereign clouds). |
| `uriEndpointOverride`, `overrideEndpoint` | | Cameleer: vault URL instead of `https://{vaultName}.vault.azure.net`. |
| `proxyHost`, `proxyPort`, `trustAllCertificates` | | Connection settings. |

### The `{{azure:...}}` placeholder

| syntax | result |
|---|---|
| `{{azure:name}}` | The secret value. |
| `{{azure:name/field}}` | A field of a JSON secret. |
| `{{azure:name@version}}` | A specific version. |
| `{{azure:name:default}}` | A default when the secret does not exist. |

Properties: `camel.vault.azure.vaultName`, `clientId`, `clientSecret`, `tenantId`,
`azureIdentityEnabled`, and (Cameleer) `authorityHost`, `uriEndpointOverride`. Secret refresh:
`camel.vault.azure.refreshEnabled=true` with `camel.vault.azure.eventhubConnectionString` (an Event Hub
that Event Grid feeds with the vault's events), optional blob checkpoint properties
(`blobAccountName`, `blobContainerName`, `blobAccessKey`), `refreshPeriod` (ms, default 30000) and
`secrets` (names or `*` patterns).

## Message headers

| header | direction | description |
|---|---|---|
| `CamelAzureKeyVaultOperation` | in | Overrides `operation`. |
| `CamelAzureKeyVaultSecretName`, `CamelAzureKeyVaultSecretVersion` | in/out | Secret and version (set by `createSecret`). |
| `CamelAzureKeyVaultKeyName`, `CamelAzureKeyVaultKeyVersion`, `CamelAzureKeyVaultKeyType`, `CamelAzureKeyVaultKeyCurve`, `CamelAzureKeyVaultKeySize`, `CamelAzureKeyVaultKeyOperations`, `CamelAzureKeyVaultKeyJwk` | in/out | Keys (type `EC` default, `RSA`, `EC-HSM`, `RSA-HSM`, `oct`, `oct-HSM`). |
| `CamelAzureKeyVaultSignatureAlgorithm`, `CamelAzureKeyVaultSignature` | in | `signData` / `verifyData` (`ES256` default, `RS256`, `PS256`, ...). |
| `CamelAzureKeyVaultEncryptionAlgorithm`, `CamelAzureKeyVaultIv`, `CamelAzureKeyVaultAuthenticationTag`, `CamelAzureKeyVaultAdditionalAuthenticatedData` | in/out | `encrypt`, `decrypt`, `wrapKey`, `unwrapKey`. |
| `CamelAzureKeyVaultCertificateName`, `CamelAzureKeyVaultCertificateVersion`, `CamelAzureKeyVaultCertificateSubject`, `CamelAzureKeyVaultCertificateValidityMonths`, `CamelAzureKeyVaultCertificatePassword` | in | Certificates. |

## Run it with Docker

```sh
docker run --rm -e AZURE_KEY_VAULT_NAME -e AZURE_TENANT_ID -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e PARTNER_TOKEN \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/vault.camel.yaml
```

## Common questions

### How do I use a managed identity?

Use `credentialType=AZURE_IDENTITY` on the endpoint (and `camel.vault.azure.azureIdentityEnabled=true`
for the placeholder); the token comes from the managed identity endpoint, workload identity or the
`AZURE_*` variables.

### How do I sign data without exporting the key?

Create a key (`createKey`), then call `signData` with the data as the body: it is hashed locally and the
digest is signed by the vault; the body becomes the signature bytes.

## Related

- [AWS Secrets Manager](aws-secrets-manager.md) (`{{aws:...}}`), [AWS KMS](aws2-kms.md)
- [Cloud credentials](../guides/cloud-credentials.md)
- [Apache Camel Azure Key Vault](https://camel.apache.org/components/next/azure-key-vault-component.html)

## Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building
with it, please help fix it, whether you are a person or a coding agent:
[open an issue](https://github.com/pmsudhi/cameleer/issues/new) that describes what you saw,
then fork the repository, fix it, add or update a test, run `cargo test --workspace`, and open
a pull request. [CONTRIBUTING.md](https://github.com/pmsudhi/cameleer/blob/main/CONTRIBUTING.md)
explains the ground rules.