Краткое руководство. Клиентская библиотека секретов Azure Key Vault для JavaScript

Необходимые компоненты

• Подписка Azure — создайте бесплатную учетную запись.
• Текущая Node.js LTS.
• Azure CLI

Необходимые компоненты

• Подписка Azure — создайте бесплатную учетную запись.
• Текущая Node.js LTS.
• TypeScript 5+
• Azure CLI.

• Создайте новый текстовый файл и вставьте приведенный ниже код в файл index.js.

  const { SecretClient } = require("@azure/keyvault-secrets");
  const { DefaultAzureCredential } = require("@azure/identity");
  
  async function main() {
    // If you're using MSI, DefaultAzureCredential should "just work".
    // Otherwise, DefaultAzureCredential expects the following three environment variables:
    // - AZURE_TENANT_ID: The tenant ID in Azure Active Directory
    // - AZURE_CLIENT_ID: The application (client) ID registered in the AAD tenant
    // - AZURE_CLIENT_SECRET: The client secret for the registered application
    const credential = new DefaultAzureCredential();
  
    const keyVaultUrl = process.env["KEY_VAULT_URL"];
    if(!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");
  
    const client = new SecretClient(keyVaultUrl, credential);
  
    // Create a secret
    // The secret can be a string of any kind. For example,
    // a multiline text block such as an RSA private key with newline characters,
    // or a stringified JSON object, like `JSON.stringify({ mySecret: 'MySecretValue'})`.
    const uniqueString = new Date().getTime();
    const secretName = `secret${uniqueString}`;
    const result = await client.setSecret(secretName, "MySecretValue");
    console.log("result: ", result);
  
    // Read the secret we created
    const secret = await client.getSecret(secretName);
    console.log("secret: ", secret);
  
    // Update the secret with different attributes
    const updatedSecret = await client.updateSecretProperties(secretName, result.properties.version, {
      enabled: false
    });
    console.log("updated secret: ", updatedSecret);
  
    // Delete the secret immediately without ability to restore or purge.
    await client.beginDeleteSecret(secretName);
  }
  
  main().catch((error) => {
    console.error("An error occurred:", error);
    process.exit(1);
  });
  

Запуск примера приложения

1. Запустите приложение:

   node index.js
   

2. Методы создания и получения возвращают полный объект JSON в секрете:

   {
       "value": "MySecretValue",
       "name": "secret1637692472606",
       "properties": {
           "createdOn": "2021-11-23T18:34:33.000Z",
           "updatedOn": "2021-11-23T18:34:33.000Z",
           "enabled": true,
           "recoverableDays": 90,
           "recoveryLevel": "Recoverable+Purgeable",
           "id": "https: //YOUR-KEYVAULT-ENDPOINT.vault.azure.net/secrets/secret1637692472606/YOUR-VERSION",
           "vaultUrl": "https: //YOUR-KEYVAULT-ENDPOINT.vault.azure.net",
           "version": "YOUR-VERSION",
           "name": "secret1637692472606"
       }
   }
   

   Метод обновления возвращает пары имени/значения свойств:

   "createdOn": "2021-11-23T18:34:33.000Z",
   "updatedOn": "2021-11-23T18:34:33.000Z",
   "enabled": true,
   "recoverableDays": 90,
   "recoveryLevel": "Recoverable+Purgeable",
   "id": "https: //YOUR-KEYVAULT-ENDPOINT/secrets/secret1637692472606/YOUR-VERSION",
   "vaultUrl": "https: //YOUR-KEYVAULT-ENDPOINT",
   "version": "YOUR-VERSION",
   "name": "secret1637692472606"
   

• Создайте текстовый файл и вставьте следующий код в файл index.ts .

  import {
    SecretClient,
    KeyVaultSecret,
    SecretProperties,
  } from "@azure/keyvault-secrets";
  import { DefaultAzureCredential } from "@azure/identity";
  import "dotenv/config";
  
  // Passwordless credential
  const credential = new DefaultAzureCredential();
  
  // Get Key Vault name from environment variables
  // such as `https://${keyVaultName}.vault.azure.net`
  const keyVaultUrl = process.env.KEY_VAULT_URL;
  if (!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");
  
  function printSecret(secret: KeyVaultSecret): void {
    const { name, value, properties } = secret;
    const { enabled, expiresOn, createdOn } = properties;
    console.log("Secret: ", { name, value, enabled, expiresOn, createdOn });
  }
  function printSecretProperties(secret: SecretProperties): void {
    const { name, enabled, expiresOn, createdOn } = secret;
    console.log("Secret: ", { name, enabled, expiresOn, createdOn });
  }
  
  async function main(): Promise<void> {
    // Create a new SecretClient
    const client = new SecretClient(keyVaultUrl, credential);
  
    // Create a unique secret name
    const uniqueString = new Date().getTime().toString();
    const secretName = `secret${uniqueString}`;
  
    // Create a secret
    const createSecretResult = await client.setSecret(
      secretName,
      "MySecretValue"
    );
    printSecret(createSecretResult);
  
    // Get the secret by name
    const getSecretResult = await client.getSecret(secretName);
    printSecret(getSecretResult);
  
    // Update properties
    const updatedSecret = await client.updateSecretProperties(
      secretName,
      getSecretResult.properties.version,
      {
        enabled: false,
      }
    );
    printSecretProperties(updatedSecret);
  
    // Delete secret (without immediate purge)
    const deletePoller = await client.beginDeleteSecret(secretName);
    await deletePoller.pollUntilDone();
  }
  
  main().catch((error) => {
    console.error("An error occurred:", error);
    process.exit(1);
  });
  

Запуск примера приложения

1. Создайте приложение TypeScript:

   tsc
   

2. Запустите приложение:

   node index.js
   

3. Методы создания и получения возвращают полный объект JSON в секрете:

   {
       "value": "MySecretValue",
       "name": "secret1637692472606",
       "properties": {
           "createdOn": "2021-11-23T18:34:33.000Z",
           "updatedOn": "2021-11-23T18:34:33.000Z",
           "enabled": true,
           "recoverableDays": 90,
           "recoveryLevel": "Recoverable+Purgeable",
           "id": "https: //YOUR-KEYVAULT-ENDPOINT.vault.azure.net/secrets/secret1637692472606/YOUR-VERSION",
           "vaultUrl": "https: //YOUR-KEYVAULT-ENDPOINT.vault.azure.net",
           "version": "YOUR-VERSION",
           "name": "secret1637692472606"
       }
   }
   

   Метод обновления возвращает пары имени/значения свойств:

   "createdOn": "2021-11-23T18:34:33.000Z",
   "updatedOn": "2021-11-23T18:34:33.000Z",
   "enabled": true,
   "recoverableDays": 90,
   "recoveryLevel": "Recoverable+Purgeable",
   "id": "https: //YOUR-KEYVAULT-ENDPOINT/secrets/secret1637692472606/YOUR-VERSION",
   "vaultUrl": "https: //YOUR-KEYVAULT-ENDPOINT",
   "version": "YOUR-VERSION",
   "name": "secret1637692472606"