Azurator

Azurator rotates shared-key credentials for Azure services and updates supported places where they are stored.

Installation

Python installations require Python 3.10 or newer. The default login uses the Azure CLI.

pipx install azurator

Other install paths:

• pip install azurator
• prebuilt archives from the latest release
• nix run github:janthmueller/azurator -- --help

The optional SOPS workflow also requires SOPS 3.13.x. See the installation guide for details.

Quick Start

Rotate keys already stored in a dotenv file:

azurator login
azurator rotate --env-file .env

Azurator matches the file values to supported Azure keys, shows every planned change, asks once for confirmation, rotates the keys, and updates the file and supported Azure configuration that stores the same values. Storage keys may be stored either as raw values or in supported Shared Key connection strings.

Inspect or preview first when needed:

azurator match --env-file .env
azurator plan --env-file .env

Other Workflows

• azurator rotate selects keys interactively.
• azurator rotate --sops-file secrets.enc.env updates a SOPS-encrypted dotenv file.
• azurator export --sops-out azure-keys.enc.env --key-map-out azurator.keys.json creates an encrypted dotenv file and its reusable secret-free key map.
• azurator export --out azure-keys.env creates a new dotenv file from selected keys.
• azurator match --sops-file secrets.enc.env --key-map-out azurator.keys.json saves mappings for azurator export --key-map azurator.keys.json --sops-out recreated.enc.env.
• azurator refresh --key-map azurator.keys.json --sops-file secrets.enc.env updates the mapped existing assignments with their current Azure values.
• azurator discover lists supported key resources without retrieving key values.

Current Scope

Azurator rotates Storage Account keys and the Key1 and Key2 credentials exposed by Azure AI, Cognitive Services, and Azure OpenAI. When the same key is stored in a selected dotenv file, a supported Foundry project connection, or an App Service application setting, Azurator can update that configuration during the rotation. Storage connection strings in supported dotenv and App Service settings keep their existing fields while AccountKey is replaced.

Azurator checks only the documented configuration types. It does not discover every Azure secret or prove that a running workload uses a key.

See Supported Key Resources and Bindings for the exact current coverage.

Shared Keys and Microsoft Entra ID

Shared keys are useful for prototypes and existing integrations, but they must be stored, distributed, and rotated. Prefer Microsoft Entra ID when the service and workload support it. Use Azurator when shared keys remain the practical choice.

Read Microsoft's guidance for secretless authentication, Foundry authentication, and Azure Storage Shared Key.

Documentation

See the documentation for setup, supported workflows, and recovery.

Contributing

See CONTRIBUTING.md.

License

MIT