Azure Kv

Read, write, and delete secrets stored in Azure Key Vault. Supports secret annotations via swamp vault annotate and swamp vault inspect. Emits OpenTelemetry spans for vault operations so failures and latency are attributable in traces when a TracerProvider is configured.

Authentication

Uses DefaultAzureCredential — no credentials in config. Provide credentials via one of:

• Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET
• Azure CLI: az login
• Managed Identity attached to the VM or container

Usage

swamp vault create @swamp/azure-kv my-azure-kv \
  --config '{"vault_url": "https://my-vault.vault.azure.net"}' --json

swamp vault get my-azure-kv my-secret --json
swamp vault put my-azure-kv my-secret "s3cr3t" --json
swamp vault delete my-azure-kv my-secret --json
swamp vault list-keys my-azure-kv --json

swamp vault annotate my-azure-kv my-secret --url https://console.azure.com --note "Production key"
swamp vault inspect my-azure-kv my-secret --json

Secret Key Format

Secret keys map to Azure Key Vault secret names. Slashes and underscores are converted to hyphens (Azure only allows alphanumeric characters and hyphens). Use secret_prefix to namespace secrets when sharing a vault across multiple swamp instances.

Annotations

Annotations are stored as Azure Key Vault secret tags with a swamp. prefix. URL, notes, and updatedAt use swamp.url, swamp.notes, swamp.updatedAt. Labels use swamp.label.<key>. Non-swamp tags are preserved across annotation operations. Annotation operations use the same secret data-plane permissions (Get, Set) — no additional Azure RBAC grants are needed.