1--- 2layout: docs 3page_title: Azure Key Vault - Seals - Configuration 4description: >- 5 The Azure Key Vault seal configures Vault to use Azure Key Vault as the seal 6 wrapping 7 8 mechanism. 9--- 10 11# `azurekeyvault` Seal 12 13The Azure Key Vault seal configures Vault to use Azure Key Vault as the seal 14wrapping mechanism. The Azure Key Vault seal is activated by one of the following: 15 16- The presence of a `seal "azurekeyvault"` block in Vault's configuration file. 17- The presence of the environment variable `VAULT_SEAL_TYPE` set to `azurekeyvault`. 18 If enabling via environment variable, all other required values specific to 19 Key Vault (i.e. `VAULT_AZUREKEYVAULT_VAULT_NAME`, etc.) must be also supplied, as 20 well as all other Azure-related environment variables that lends to successful 21 authentication (i.e. `AZURE_TENANT_ID`, etc.). 22 23## `azurekeyvault` Example 24 25This example shows configuring Azure Key Vault seal through the Vault 26configuration file by providing all the required values: 27 28```hcl 29seal "azurekeyvault" { 30 tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" 31 client_id = "03dc33fc-16d9-4b77-8152-3ec568f8af6e" 32 client_secret = "DUJDS3..." 33 vault_name = "hc-vault" 34 key_name = "vault_key" 35} 36``` 37 38## `azurekeyvault` Parameters 39 40These parameters apply to the `seal` stanza in the Vault configuration file: 41 42- `tenant_id` `(string: <required>)`: The tenant id for the Azure Active Directory organization. May 43 also be specified by the `AZURE_TENANT_ID` environment variable. 44 45- `client_id` `(string: <required or MSI>)`: The client id for credentials to query the Azure APIs. 46 May also be specified by the `AZURE_CLIENT_ID` environment variable. 47 48- `client_secret` `(string: <required or MSI>)`: The client secret for credentials to query the Azure APIs. 49 May also be specified by the `AZURE_CLIENT_SECRET` environment variable. 50 51- `environment` `(string: "AZUREPUBLICCLOUD")`: The Azure Cloud environment API endpoints to use. May also 52 be specified by the `AZURE_ENVIRONMENT` environment variable. 53 54- `vault_name` `(string: <required>)`: The Key Vault vault to use the encryption keys for encryption and 55 decryption. May also be specified by the `VAULT_AZUREKEYVAULT_VAULT_NAME` environment variable. 56 57- `key_name` `(string: <required>)`: The Key Vault key to use for encryption and decryption. May also be specified by the 58 `VAULT_AZUREKEYVAULT_KEY_NAME` environment variable. 59 60## Authentication 61 62Authentication-related values must be provided, either as environment 63variables or as configuration parameters. 64 65Azure authentication values: 66 67- `AZURE_TENANT_ID` 68- `AZURE_CLIENT_ID` 69- `AZURE_CLIENT_SECRET` 70- `AZURE_ENVIRONMENT` 71 72~> **Note:** If Vault is hosted on Azure, Vault can use Managed Service 73Identities (MSI) to access Azure instead of an environment and shared client id 74and secret. MSI must be 75[enabled](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/qs-configure-portal-windows-vm) 76on the VMs hosting Vault, and it is the preferred configuration since MSI 77prevents your Azure credentials from being stored as clear text. Refer to the 78[Production 79Hardening](https://learn.hashicorp.com/vault/day-one/production-hardening) guide 80for more best practices. 81 82## `azurekeyvault` Environment Variables 83 84Alternatively, the Azure Key Vault seal can be activated by providing the following 85environment variables: 86 87- `VAULT_AZUREKEYVAULT_VAULT_NAME` 88- `VAULT_AZUREKEYVAULT_KEY_NAME` 89 90## Key Rotation 91 92This seal supports rotating keys defined in Azure Key Vault. Key metadata is 93stored with the encrypted data to ensure the correct key is used during 94decryption operations. Simply [set up Azure Key Vault with key 95rotation](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring) 96using Azure Automation Account and Vault will recognize newly rotated keys. 97 98## Learn 99 100Refer to the [Auto-unseal using Azure Key Vault](https://learn.hashicorp.com/vault/operations/autounseal-azure-keyvault) 101guide for a step-by-step tutorial. 102