Azure Key Vault Secrets SDK for Java Acceptance Criteria

SDK: com.azure:azure-security-keyvault-secretsRepository: https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/keyvault-v2/azure-security-keyvault-secretsPurpose: Skill testing acceptance criteria for validating generated code correctness

---

1. Correct Import Patterns

1.1 Client Imports

✅ CORRECT: Secret Clients

import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;
import com.azure.security.keyvault.secrets.SecretAsyncClient;

✅ CORRECT: Authentication

import com.azure.identity.DefaultAzureCredentialBuilder;

1.2 Model Imports

✅ CORRECT: Secret Models

import com.azure.security.keyvault.secrets.models.KeyVaultSecret;
import com.azure.security.keyvault.secrets.models.SecretProperties;
import com.azure.security.keyvault.secrets.models.DeletedSecret;

---

2. Client Creation Patterns

2.1 ✅ CORRECT: Builder with DefaultAzureCredential

String vaultUrl = System.getenv("AZURE_KEYVAULT_URL");

SecretClient secretClient = new SecretClientBuilder()
    .vaultUrl(vaultUrl)
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

2.2 ✅ CORRECT: Async Client

SecretAsyncClient secretAsyncClient = new SecretClientBuilder()
    .vaultUrl(vaultUrl)
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildAsyncClient();

---

3. Secret Operations

3.1 ✅ CORRECT: Set Secret

KeyVaultSecret secret = secretClient.setSecret("database-password", "P@ssw0rd123!");
System.out.println("Secret name: " + secret.getName());

3.2 ✅ CORRECT: Set Secret with Options

KeyVaultSecret secretWithOptions = secretClient.setSecret(
    new KeyVaultSecret("api-key", "sk_live_abc123xyz")
        .setProperties(new SecretProperties()
            .setContentType("text/plain")
            .setExpiresOn(OffsetDateTime.now().plusYears(1))
            .setTags(Map.of("environment", "production"))));

3.3 ✅ CORRECT: Get Secret

KeyVaultSecret secret = secretClient.getSecret("database-password");
String value = secret.getValue();

3.4 ✅ CORRECT: List Secrets

for (SecretProperties props : secretClient.listPropertiesOfSecrets()) {
    System.out.println("Secret: " + props.getName());
}

3.5 ✅ CORRECT: Delete Secret

SyncPoller<DeletedSecret, Void> deletePoller = secretClient.beginDeleteSecret("old-secret");
deletePoller.waitForCompletion();

---

4. Secret Rotation Pattern

4.1 ✅ CORRECT: Rotate Secret

public void rotateSecret(String secretName, String newValue) {
    KeyVaultSecret current = secretClient.getSecret(secretName);
    
    // Disable old version
    current.getProperties().setEnabled(false);
    secretClient.updateSecretProperties(current.getProperties());
    
    // Create new version
    KeyVaultSecret newSecret = secretClient.setSecret(secretName, newValue);
    System.out.println("Rotated to version: " + newSecret.getProperties().getVersion());
}

---

5. Backup and Restore

5.1 ✅ CORRECT: Backup and Restore

// Backup
byte[] backup = secretClient.backupSecret("important-secret");
Files.write(Paths.get("secret-backup.blob"), backup);

// Restore
byte[] backupData = Files.readAllBytes(Paths.get("secret-backup.blob"));
KeyVaultSecret restored = secretClient.restoreSecretBackup(backupData);

---

6. Error Handling

6.1 ✅ CORRECT: Exception Handling

import com.azure.core.exception.HttpResponseException;
import com.azure.core.exception.ResourceNotFoundException;

try {
    KeyVaultSecret secret = secretClient.getSecret("my-secret");
} catch (ResourceNotFoundException e) {
    System.out.println("Secret not found");
} catch (HttpResponseException e) {
    int status = e.getResponse().getStatusCode();
    if (status == 403) {
        System.out.println("Access denied");
    } else if (status == 429) {
        System.out.println("Rate limited");
    }
}

---

7. Best Practices Checklist

• [ ] Use DefaultAzureCredential for authentication
• [ ] Use environment variables for vault URL
• [ ] Enable soft delete on vault
• [ ] Use tags to organize secrets
• [ ] Set expiration dates for credentials
• [ ] Set content type to indicate format
• [ ] Don't delete old versions immediately during rotation
• [ ] Enable diagnostic logging on Key Vault