Azure Key Vault Helper

A Python helper library for easily retrieving secrets from Azure Key Vault with support for development and production environments.

Features

• Simple interface for retrieving secrets from Azure Key Vault
• Automatic authentication using Azure Default Credentials
• Environment-aware: different behavior for development and production
• Fallback to environment variables when needed
• Batch secret retrieval support

Installation

pip install azure-keyvault-helper

Prerequisites

For Local Development

• Azure CLI installed and logged in (az login)
• Or set environment variables:
  • AZURE_CLIENT_ID
  • AZURE_TENANT_ID
  • AZURE_CLIENT_SECRET (if using service principal)

For Production

• Managed Identity enabled (when running in Azure)
• Or Service Principal configured with appropriate environment variables

Configuration

Set the following environment variables:

• KEYVAULT_URL: The URL of your Azure Key Vault (e.g., https://myvault.vault.azure.net/)
• ENVIRONMENT: Set to development or production (defaults to production)

Usage

Basic Usage

from azure_keyvault_helper import AzureKeyVaultHelper

# Initialize the helper
helper = AzureKeyVaultHelper()

# Get a single secret
secret_value = helper.get_secret("my-secret-name")
print(secret_value)

Using Global Helper

from azure_keyvault_helper import get_secret

# Automatically uses Key Vault or environment variables based on ENVIRONMENT
api_key = get_secret("api-key", fallback_env_var="API_KEY")

Batch Retrieval

from azure_keyvault_helper import AzureKeyVaultHelper

helper = AzureKeyVaultHelper()
secrets = helper.get_secrets_batch(["secret1", "secret2", "secret3"])
print(secrets)

Environment-Aware Usage

The library behaves differently based on the ENVIRONMENT variable:

Development Mode (ENVIRONMENT=development):

• Prefers environment variables over Key Vault
• Useful for local development without Key Vault access

Production Mode (ENVIRONMENT=production or unset):

• Uses Azure Key Vault primarily
• Falls back to environment variables if Key Vault is unavailable

import os
os.environ["ENVIRONMENT"] = "development"

from azure_keyvault_helper import get_secret

# In development: uses API_KEY env var if available
# In production: uses Key Vault secret "api-key", falls back to API_KEY env var
api_key = get_secret("api-key", fallback_env_var="API_KEY")

Authentication

The library uses DefaultAzureCredential which tries multiple authentication methods in order:

1. Environment variables (for service principal)
2. Managed Identity (when running in Azure)
3. Azure CLI (when running locally and logged in)
4. Visual Studio Code (if using VS Code Azure extension)
5. Azure PowerShell (if authenticated)

License

MIT

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.