AI 原生开放教材

外观

Microsoft Agent Skills技能与配置库·英文原文 ↗原件 ↓仓库 ↗

Azure Key Vault SDK Acceptance Criteria ​

SDK: azure-keyvault-secrets, azure-keyvault-keys, azure-keyvault-certificatesRepository: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/keyvaultCommit: mainPurpose: Skill testing acceptance criteria for validating generated code correctness

1. Correct Import Patterns ​

1.1 ✅ CORRECT: Sync Client Imports ​

python
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from azure.keyvault.keys import KeyClient
from azure.keyvault.certificates import CertificateClient, CertificatePolicy

1.2 ✅ CORRECT: Async Client Imports ​

python
from azure.identity.aio import DefaultAzureCredential
from azure.keyvault.secrets.aio import SecretClient
from azure.keyvault.keys.aio import KeyClient
from azure.keyvault.certificates.aio import CertificateClient

1.3 ✅ CORRECT: Cryptography Imports ​

python
from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm, SignatureAlgorithm

1.4 Anti-Patterns (ERRORS) ​

❌ INCORRECT: Wrong module paths or legacy clients ​

python
# WRONG - legacy SDK
from azure.keyvault import KeyVaultClient

# WRONG - async client should be imported from .aio
from azure.keyvault.secrets import SecretClient as AsyncSecretClient

# WRONG - crypto client is not in azure.keyvault.keys
from azure.keyvault.keys import CryptographyClient

2. SecretClient ​

2.1 ✅ CORRECT: Client Creation ​

python
import os
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

vault_url = os.environ["AZURE_KEYVAULT_URL"]
credential = DefaultAzureCredential()

client = SecretClient(vault_url=vault_url, credential=credential)

2.2 ✅ CORRECT: Set and Get Secret ​

python
secret = client.set_secret("database-password", "super-secret-value")
latest = client.get_secret("database-password")
print(latest.value)

2.3 ✅ CORRECT: List Secret Properties and Versions ​

python
for secret_props in client.list_properties_of_secrets():
    print(secret_props.name)

for version_props in client.list_properties_of_secret_versions("database-password"):
    print(version_props.version)

2.4 ✅ CORRECT: Delete, Purge, Recover ​

python
poller = client.begin_delete_secret("database-password")
deleted = poller.result()

client.purge_deleted_secret("database-password")
client.begin_recover_deleted_secret("database-password").result()

2.5 Anti-Patterns (ERRORS) ​

❌ INCORRECT: Wrong parameter name ​

python
# WRONG - SecretClient expects vault_url
client = SecretClient(url="https://vault.vault.azure.net/", credential=credential)

3. KeyClient ​

3.1 ✅ CORRECT: Client Creation ​

python
import os
from azure.identity import DefaultAzureCredential
from azure.keyvault.keys import KeyClient

vault_url = os.environ["AZURE_KEYVAULT_URL"]
credential = DefaultAzureCredential()

client = KeyClient(vault_url=vault_url, credential=credential)

3.2 ✅ CORRECT: Create RSA and EC Keys ​

python
rsa_key = client.create_rsa_key("rsa-key", size=2048)
ec_key = client.create_ec_key("ec-key", curve="P-256")

3.3 ✅ CORRECT: Get and List Keys ​

python
key = client.get_key("rsa-key")
print(key.name)

for key_props in client.list_properties_of_keys():
    print(key_props.name)

3.4 ✅ CORRECT: Delete Key ​

python
poller = client.begin_delete_key("rsa-key")
deleted = poller.result()
print(deleted.name)

3.5 ✅ CORRECT: Cryptography Operations ​

python
from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm, SignatureAlgorithm
import hashlib

key = client.get_key("rsa-key")
crypto_client = CryptographyClient(key, credential=credential)

encrypted = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, b"hello")
decrypted = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep, encrypted.ciphertext)

digest = hashlib.sha256(b"data").digest()
signature = crypto_client.sign(SignatureAlgorithm.rs256, digest).signature
verified = crypto_client.verify(SignatureAlgorithm.rs256, digest, signature)
print(verified.is_valid)

3.6 Anti-Patterns (ERRORS) ​

❌ INCORRECT: Wrong client class for keys ​

python
# WRONG - keys are managed by KeyClient
from azure.keyvault.secrets import SecretClient
client = SecretClient(vault_url=vault_url, credential=credential)
client.create_rsa_key("rsa-key", size=2048)

4. CertificateClient ​

4.1 ✅ CORRECT: Client Creation ​

python
import os
from azure.identity import DefaultAzureCredential
from azure.keyvault.certificates import CertificateClient, CertificatePolicy

vault_url = os.environ["AZURE_KEYVAULT_URL"]
credential = DefaultAzureCredential()

client = CertificateClient(vault_url=vault_url, credential=credential)
policy = CertificatePolicy.get_default()

4.2 ✅ CORRECT: Create and Get Certificate ​

python
poller = client.begin_create_certificate("my-cert", policy=policy)
certificate = poller.result()

latest = client.get_certificate("my-cert")
print(latest.name)

4.3 ✅ CORRECT: List Certificates ​

python
for cert_props in client.list_properties_of_certificates():
    print(cert_props.name)

4.4 ✅ CORRECT: Delete Certificate ​

python
poller = client.begin_delete_certificate("my-cert")
deleted = poller.result()
print(deleted.name)

4.5 Anti-Patterns (ERRORS) ​

❌ INCORRECT: Using create_certificate on sync client ​

python
# WRONG - sync client uses begin_create_certificate
client.create_certificate("my-cert", policy=policy)

5. CRUD Operations ​

5.1 ✅ CORRECT: Secret, Key, Certificate CRUD ​

python
# Secret CRUD
secret = secret_client.set_secret("app-secret", "value")
secret = secret_client.get_secret("app-secret")
secret_client.begin_delete_secret("app-secret").result()

# Key CRUD
key = key_client.create_rsa_key("app-key", size=2048)
key = key_client.get_key("app-key")
key_client.begin_delete_key("app-key").result()

# Certificate CRUD
cert = cert_client.begin_create_certificate("app-cert", policy=policy).result()
cert = cert_client.get_certificate("app-cert")
cert_client.begin_delete_certificate("app-cert").result()

6. Async Variants ​

6.1 ✅ CORRECT: Async SecretClient Usage ​

python
import os
import asyncio
from azure.identity.aio import DefaultAzureCredential
from azure.keyvault.secrets.aio import SecretClient

async def main():
    vault_url = os.environ["AZURE_KEYVAULT_URL"]
    credential = DefaultAzureCredential()

    async with SecretClient(vault_url=vault_url, credential=credential) as client:
        secret = await client.get_secret("my-secret")
        print(secret.value)

if __name__ == "__main__":
    asyncio.run(main())

6.2 ✅ CORRECT: Async KeyClient and CertificateClient Listing ​

python
import os
import asyncio
from azure.identity.aio import DefaultAzureCredential
from azure.keyvault.keys.aio import KeyClient
from azure.keyvault.certificates.aio import CertificateClient

async def main():
    vault_url = os.environ["AZURE_KEYVAULT_URL"]
    credential = DefaultAzureCredential()

    async with KeyClient(vault_url=vault_url, credential=credential) as key_client:
        async for key_props in key_client.list_properties_of_keys():
            print(key_props.name)

    async with CertificateClient(vault_url=vault_url, credential=credential) as cert_client:
        async for cert_props in cert_client.list_properties_of_certificates():
            print(cert_props.name)

if __name__ == "__main__":
    asyncio.run(main())

6.3 Anti-Patterns (ERRORS) ​

❌ INCORRECT: Sync credential with async client or missing async for ​

python
from azure.identity import DefaultAzureCredential
from azure.keyvault.keys.aio import KeyClient

credential = DefaultAzureCredential()  # WRONG - should be azure.identity.aio
client = KeyClient(vault_url=vault_url, credential=credential)

for item in client.list_properties_of_keys():  # WRONG - async iterator
    print(item.name)