Azure Key Vault Key Encryptor for Microsoft.AspNetCore.DataProtection

The Azure.Extensions.AspNetCore.DataProtection.Keys package allows protecting keys at rest using Azure Key Vault Key Encryption/Wrapping feature.

Getting started

Install the package

Install the package with NuGet:

dotnet add package Azure.Extensions.AspNetCore.DataProtection.Keys

Prerequisites

You need an Azure subscription, Key Vault and a Key to use this package.

To create a new Key Vault, you can use the Azure Portal, Azure PowerShell, or the Azure CLI. Here's an example using the Azure CLI:

az keyvault create --name MyVault --resource-group MyResourceGroup --location westus az keyvault key create --name MyKey --vault-name MyVault # give write access to a service principal (application) az keyvault set-policy -n MyVault --object-id <application_id> --key-permissions get unwrapKey wrapKey

Key concepts

Thread safety

We guarantee that all client instance methods are thread-safe and independent of each other (guideline). This ensures that the recommendation of reusing client instances is always safe, even across threads.

Additional concepts

Client options | Accessing the response | | | | |