azure.keyvault.administration.aio package¶

class azure.keyvault.administration.aio.KeyVaultAccessControlClient(vault_url: str, credential: AsyncTokenCredential, **kwargs: Any)[source]¶

Manages role-based access to Azure Key Vault.

Parameters

vault_url (str) – URL of the vault the client will manage. This is also called the vault’s “DNS Name”.
credential – an object which can provide an access token for the vault, such as a credential from azure.identity

async close() → None ¶

Close sockets opened by the client.

Calling this method is unnecessary when using the client as a context manager.

async create_role_assignment(role_scope: Union[str, KeyVaultRoleScope], role_definition_id: str, principal_id: str, **kwargs: Any) → azure.keyvault.administration._models.KeyVaultRoleAssignment[source]¶

Create a role assignment.

Parameters

role_scope (str or KeyVaultRoleScope) – scope the role assignment will apply over. KeyVaultRoleScope defines common broad scopes. Specify a narrower scope as a string.
role_definition_id (str) – ID of the role’s definition
principal_id (str) – Azure Active Directory object ID of the principal which will be assigned the role. The principal can be a user, service principal, or security group.

Keyword Arguments

role_assignment_name – a name for the role assignment. Must be a UUID.

Return type

KeyVaultRoleAssignment

async delete_role_assignment(role_scope: Union[str, KeyVaultRoleScope], role_assignment_name: Union[str, UUID], **kwargs: Any) → azure.keyvault.administration._models.KeyVaultRoleAssignment[source]¶

Delete a role assignment.

Parameters

role_scope (str or KeyVaultRoleScope) – the assignment’s scope, for example “/”, “/keys”, or “/keys/<specific key identifier>”. KeyVaultRoleScope defines common broad scopes. Specify a narrower scope as a string.
role_assignment_name (str or uuid.UUID) – the assignment’s name. Must be a UUID.

Returns

the deleted assignment

Return type

KeyVaultRoleAssignment

async get_role_assignment(role_scope: Union[str, KeyVaultRoleScope], role_assignment_name: Union[str, UUID], **kwargs: Any) → azure.keyvault.administration._models.KeyVaultRoleAssignment[source]¶

Get a role assignment.

Parameters

role_scope (str or KeyVaultRoleScope) – the assignment’s scope, for example “/”, “/keys”, or “/keys/<specific key identifier>”. KeyVaultRoleScope defines common broad scopes. Specify a narrower scope as a string.
role_assignment_name (str or uuid.UUID) – the assignment’s name. Must be a UUID.

Return type

KeyVaultRoleAssignment

list_role_assignments(role_scope: Union[str, KeyVaultRoleScope], **kwargs: Any) → AsyncItemPaged[KeyVaultRoleAssignment][source]¶

List all role assignments for a scope.

Parameters: role_scope (str or KeyVaultRoleScope) – scope of the role assignments. KeyVaultRoleScope defines common broad scopes. Specify a narrower scope as a string.
Return type: AsyncItemPaged[KeyVaultRoleAssignment]

list_role_definitions(role_scope: Union[str, KeyVaultRoleScope], **kwargs: Any) → AsyncItemPaged[KeyVaultRoleDefinition][source]¶

List all role definitions applicable at and above a scope.

Parameters: role_scope (str or KeyVaultRoleScope) – scope of the role definitions. KeyVaultRoleScope defines common broad scopes. Specify a narrower scope as a string.
Return type: AsyncItemPaged[KeyVaultRoleDefinition]

property vault_url¶

class azure.keyvault.administration.aio.KeyVaultBackupClient(vault_url: str, credential: AsyncTokenCredential, **kwargs: Any)[source]¶

Performs Key Vault backup and restore operations.

Parameters

vault_url (str) – URL of the vault on which the client will operate. This is also called the vault’s “DNS Name”.
credential – an object which can provide an access token for the vault, such as a credential from azure.identity.aio

async begin_full_backup(blob_storage_uri: str, sas_token: str, **kwargs: Any) → AsyncLROPoller[BackupOperation][source]¶

Begin a full backup of the Key Vault.

Parameters

blob_storage_uri (str) – URI of the blob storage resource in which the backup will be stored
sas_token (str) – a Shared Access Signature (SAS) token authorizing access to the blob storage resource

Keyword Arguments

continuation_token (str) – a continuation token to restart polling from a saved state

Returns

An AsyncLROPoller. Call result() on this object to get a BackupOperation.

Return type

AsyncLROPoller[BackupOperation]

async begin_full_restore(blob_storage_uri: str, sas_token: str, folder_name: str, **kwargs: Any) → AsyncLROPoller[RestoreOperation][source]¶

Restore a full backup of a Key Vault.

Parameters

blob_storage_uri (str) – URI of the blob storage resource in which the backup is stored
sas_token (str) – a Shared Access Signature (SAS) token authorizing access to the blob storage resource
folder_name (str) – name of the blob container which contains the backup

Return type

AsyncLROPoller[RestoreOperation]

async begin_selective_restore(blob_storage_uri: str, sas_token: str, folder_name: str, key_name: str, **kwargs: Any) → AsyncLROPoller[SelectiveKeyRestoreOperation][source]¶

Restore a single key from a full Key Vault backup.

Parameters

blob_storage_uri (str) – URI of the blob storage resource in which the backup is stored
sas_token (str) – a Shared Access Signature (SAS) token authorizing access to the blob storage resource
folder_name (str) – name of the blob container which contains the backup
key_name (str) – name of the key to restore from the backup

Return type

AsyncLROPoller[RestoreOperation]

async close() → None ¶

Close sockets opened by the client.

Calling this method is unnecessary when using the client as a context manager.

async get_backup_status(job_id: str, **kwargs: Any) → BackupOperation[source]¶

Returns the status of a full backup operation.

Parameters: job_id (str) – The job ID returned as part of the backup request
Returns: The full backup operation status as a BackupOperation
Return type: BackupOperation

async get_restore_status(job_id: str, **kwargs: Any) → RestoreOperation[source]¶

Returns the status of a restore operation.

Parameters: job_id (str) – The ID returned as part of the restore request
Returns: The restore operation status as a RestoreOperation
Return type: RestoreOperation

property vault_url¶