azure-key-vault

Azure Key Vault 技能

此技能提供 Azure Key Vault 专家指南，涵盖故障排除、最佳实践、决策、限制和配额、安全性、配置、集成和编码模式，以及部署。它结合了本地快速参考内容与远程文档获取功能。

如何使用此技能

IMPORTANT for Agent：使用下方的类别索引查找相关章节。对于带行号范围的类别（例如 L35-L120），请使用 read_file 读取指定行。对于带文件链接的类别（例如 [security.md](security.md)），请使用 read_file 读取链接的参考文件

IMPORTANT for Agent：如果 metadata.generated_at 距今超过 3 个月，请建议用户从仓库拉取最新版本。如果 mcp_microsoftdocs 工具不可用，请建议用户安装：安装指南

此技能需要网络访问权限才能获取文档内容：

• 首选：使用 mcp_microsoftdocs:microsoft_docs_fetch，查询字符串为 from=learn-agent-skill。返回 Markdown。
• 备用：使用 fetch_webpage，查询字符串为 from=learn-agent-skill&accept=text/markdown。返回 Markdown。

类别索引

类别	行号	描述
故障排除	L36-L45	诊断和修复 Key Vault 错误：REST/API 代码、Private Link 配置错误、访问策略/Policy 强制实施问题，以及 Managed HSM 外部密钥管理故障。
最佳实践	L46-L52	有关保护 Key Vault 密钥、处理 Managed HSM 灾难恢复，以及生成/导入 BYOK HSM 密钥以实现合规、弹性密钥管理的最佳实践。
决策	L53-L63	有关选择访问控制模型、安全更新 Key Vault API，以及规划/迁移密钥工作负载的指南，包括外部密钥和 Managed HSM 容量、扩展及 SLA。
限制和配额	L64-L75	Key Vault 和 Managed HSM 的限制、配额和行为（证书、机密、限流、日志延迟、IP 防火墙/网络规则、软删除/恢复及容量限制）。
安全性	L76-L106	保护 Azure Key Vault 和 Managed HSM：身份验证（Entra ID、RBAC/ABAC、访问策略）、网络/防火墙/专用终结点、零信任、BYOK/HSM 密钥传输、备份/还原及最佳实践。
配置	L107-L130	配置 Key Vault 和 Managed HSM，以进行监视、日志记录、警报、策略、密钥/机密类型和轮换、安全密钥发布、BYOK 导入，以及软删除/清除保护。
集成和编码模式	L131-L159	将 Key Vault 与应用和服务集成的模式和代码示例（Event Grid、Logic Apps、Databricks、Private Link），以及使用 .NET、Node.js、Python 和 JavaScript 中的密钥/机密。
部署	L160-L163	使用 ARM 模板、Bicep、Terraform、Azure CLI 和 PowerShell 部署和预配 Azure Key Vault 和 Managed HSM（保管库、密钥、机密）

故障排除

主题	URL
解决常见的 Azure Key Vault 错误代码	https://learn.microsoft.com/en-us/azure/key-vault/general/common-error-codes
诊断和修复 Azure Key Vault Private Link 配置问题	https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics
解读 Azure Key Vault REST API 错误代码	https://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes
排查 Azure Policy 对 Key Vault 的强制实施问题	https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshoot-azure-policy-for-key-vault
排查 Azure Key Vault 访问策略故障	https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshooting-access-issues
排查 Managed HSM 外部密钥管理故障	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-troubleshooting

最佳实践

主题	URL
应用 Azure Key Vault 密钥的安全最佳实践	https://learn.microsoft.com/en-us/azure/key-vault/keys/secure-keys
应对 Azure Managed HSM 中断执行灾难恢复	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/disaster-recovery-guide
在 Azure Managed HSM 中生成并导入 BYOK HSM 密钥	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/hsm-protected-keys-byok

决策

主题	URL
为 Key Vault 选择默认访问控制模型	https://learn.microsoft.com/en-us/azure/key-vault/general/access-control-default
安全更新 Azure Key Vault API 版本	https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-api-version
规划并执行加密密钥工作负载迁移	https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-key-workloads
将 Azure Key Vault 从访问策略迁移到 RBAC	https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-migration
规划从外部密钥迁移到 Managed HSM 密钥	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-migration
评估 Managed HSM 外部密钥的 SLA 和责任	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-shared-responsibility
规划 Azure Managed HSM 的容量和扩缩	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/scaling-guidance

限制和配额

主题	URL
了解 Azure Key Vault 证书限制和行为	https://learn.microsoft.com/en-us/azure/key-vault/certificates/faq
配置并解读 Azure Key Vault 日志延迟	https://learn.microsoft.com/en-us/azure/key-vault/general/logging
了解并管理 Azure Key Vault 限流限制	https://learn.microsoft.com/en-us/azure/key-vault/general/overview-throttling
查看 Azure Key Vault 和 Managed HSM 服务限制	https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits
配置 Managed HSM IP 防火墙和网络安全	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/configure-network-security
查看 Azure Managed HSM 服务限制和配额	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/service-limits
对 Managed HSM 资源使用软删除和恢复	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/soft-delete-overview
了解 Azure Key Vault 机密大小限制	https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets

安全

主题	URL
对 Key Vault 证书应用安全最佳实践	https://learn.microsoft.com/en-us/azure/key-vault/certificates/secure-certificates
允许防火墙后的客户端访问 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/general/access-behind-firewall
使用 CLI 配置 Azure Key Vault 访问策略	https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy
使用 Entra ID 配置 Azure Key Vault 身份验证	https://learn.microsoft.com/en-us/azure/key-vault/general/authentication
通过 CLI 为 Key Vault 添加 Azure ABAC 条件	https://learn.microsoft.com/en-us/azure/key-vault/general/howto-abac-conditions-cli
通过 PowerShell 为 Key Vault 添加 Azure ABAC 条件	https://learn.microsoft.com/en-us/azure/key-vault/general/howto-abac-conditions-powershell
配置 Azure Key Vault 网络安全选项	https://learn.microsoft.com/en-us/azure/key-vault/general/network-security
使用虚拟网络服务终结点保护 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints
配置 Azure Key Vault ABAC 操作和属性	https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-abac
为 Key Vault 选择 Azure RBAC 或访问策略	https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy
配置 Azure Key Vault 的 Azure RBAC 访问权限	https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
对 Azure Key Vault 应用零信任安全实践	https://learn.microsoft.com/en-us/azure/key-vault/general/secure-key-vault
安全地配置和使用 Azure Key Vault 软删除	https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview
生成 HSM 保护的密钥并将其传输到 Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys
为 Azure Key Vault 实施 BYOK HSM 密钥传输	https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys-byok
管理 Managed HSM 的访问控制和授权	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/access-control
配置用于 Managed HSM 密钥管理的 ARM 访问权限	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/authorize-azure-resource-manager
使用 Azure Policy 强制实施 Managed HSM 治理	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/azure-policy
对 Azure Managed HSM 执行完整和选择性备份/还原	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/backup-restore
使用 Managed HSM 内置本地 RBAC 角色	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/built-in-roles
为 Managed HSM 外部密钥配置网络和 mTLS	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-networking
为 Azure Managed HSM 实施安全访问控制	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/how-to-secure-access
配置 Managed HSM 的网络安全和防火墙	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/network-security
使用 Private Link 配置 Managed HSM 专用终结点	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/private-link
管理 Azure Managed HSM 的数据平面 RBAC 角色	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/role-management
对 Managed HSM 部署应用安全最佳实践	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/secure-managed-hsm
对 Key Vault 机密应用安全最佳实践	https://learn.microsoft.com/en-us/azure/key-vault/secrets/secure-secrets

配置

主题	URL
配置 Azure Key Vault 的运行状况和请求限制警报	https://learn.microsoft.com/en-us/azure/key-vault/general/alert
构造经过身份验证的 Azure Key Vault JSON 请求	https://learn.microsoft.com/en-us/azure/key-vault/general/authentication-requests-and-responses
应用 Azure Policy 管理 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy
启用并配置 Azure Key Vault 诊断日志记录	https://learn.microsoft.com/en-us/azure/key-vault/general/howto-logging
使用 Azure Monitor 配置 Azure Key Vault 监视	https://learn.microsoft.com/en-us/azure/key-vault/general/monitor-key-vault
参考 Azure Key Vault 监视指标和日志	https://learn.microsoft.com/en-us/azure/key-vault/general/monitor-key-vault-reference
使用 Azure Key Vault 密钥类型和算法	https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-details
遵循 BYOK 规范，将 HSM 密钥导入 Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/keys/byok-specification
配置 Azure Key Vault 中的加密密钥自动轮换	https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
在 Key Vault 中编写安全密钥发布策略	https://learn.microsoft.com/en-us/azure/key-vault/keys/policy-grammar
配置 Managed HSM 中的密钥类型和算法	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/about-keys-details
配置 Managed HSM 的运行状况和性能警报	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/configure-alerts
配置 Managed HSM 外部密钥的日志记录和监视	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-logging-monitoring
配置 Azure Managed HSM 中的密钥自动轮换	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/key-rotation
配置 Azure Managed HSM 的日志记录和审核事件	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/logging
为 Managed HSM 编写安全密钥发布策略	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/policy-grammar
配置 Managed HSM 的软删除和清除保护	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/recovery
配置 Azure Key Vault 以存储多行机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/multiline-secrets
自动轮换 Key Vault 中的单凭据机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation
配置 Key Vault 中双凭据机密的轮换	https://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation-dual

集成与编码模式

主题	URL
将 Azure Key Vault 与 DigiCert CA 集成	https://learn.microsoft.com/en-us/azure/key-vault/certificates/how-to-integrate-certificate-authority
通过 Event Grid 根据 Key Vault 事件触发 Logic Apps	https://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-logicapps
将 Azure Key Vault 事件与 Azure Event Grid 集成	https://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-overview
使用 Event Grid 和 Automation 处理 Azure Key Vault 通知	https://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-tutorial
使用 Key Vault 机密通过 Databricks 访问 Blob Storage	https://learn.microsoft.com/en-us/azure/key-vault/general/integrate-databricks-blob-storage
将 Azure Key Vault 与 Azure Private Link 集成	https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service
在 VM 上使用 Node.js 从 Key Vault 读取机密	https://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-javascript-virtual-machine
将 ASP.NET Core Web 应用连接到 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-net-create-vault-azure-web-app
将 .NET VM 应用与 Azure Key Vault 机密集成	https://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-net-virtual-machine
在虚拟机上使用 Python 访问 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/general/tutorial-python-virtual-machine
在 JavaScript 中备份、删除和还原密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-backup-delete-restore-key
在 JavaScript 中创建和轮换 Key Vault 密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-create-update-rotate-key
在 JavaScript 中启用或禁用 Key Vault 密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-enable-disable-key
在 JavaScript 中使用 Key Vault 密钥加密和解密	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-encrypt-decrypt-key
在 JavaScript 中检索 Azure Key Vault 密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-get-key
使用 JavaScript 将密钥导入 Azure Key Vault	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-import-key
使用 JavaScript 列出 Azure Key Vault 密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-list-key-version
在 JavaScript 中使用 Key Vault 密钥进行签名和验证	https://learn.microsoft.com/en-us/azure/key-vault/keys/javascript-developer-guide-sign-verify-key
为 Managed HSM 外部密钥实现 EKM Proxy API	https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-proxy-api-reference
在 JavaScript 中备份和还原 Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-backup-secrets
使用 JavaScript 删除和清除 Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-delete-secret
使用 JavaScript 启用或禁用 Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-enable-disable-secret
使用 JavaScript 检索 Azure Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-get-secret
在 JavaScript 应用中使用 Azure Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-get-started
使用 JavaScript 创建、更新和轮换 Key Vault 机密	https://learn.microsoft.com/en-us/azure/key-vault/secrets/javascript-developer-guide-set-update-rotate-secret

部署

主题	URL
使用 Terraform 预配 Key Vault 和密钥	https://learn.microsoft.com/en-us/azure/key-vault/keys/quick-create-terraform