1# Azure Key Vault
2 
3Centralized secrets, keys, and certificate management.
4 
5## When to Use
6 
7- Storing application secrets
8- Managing certificates
9- Storing encryption keys
10- Centralizing secret management
11- Enabling secret rotation
12 
13## Required Supporting Resources
14 
15| Resource | Purpose |
16|----------|---------|
17| None required | Key Vault is self-contained |
18| Private Endpoint | Secure access (optional) |
19 
20## SKU Selection
21 
22| SKU | Features |
23|-----|----------|
24| Standard | Software-protected keys |
25| Premium | HSM-protected keys |
26 
27## RBAC Roles
28 
29| Role | Permissions |
30|------|-------------|
31| Key Vault Administrator | Full access |
32| Key Vault Secrets Officer | Manage secrets |
33| Key Vault Secrets User | Read secrets |
34| Key Vault Certificates Officer | Manage certificates |
35| Key Vault Crypto Officer | Manage keys |
36 
37## Environment Variables
38 
39| Variable | Value |
40|----------|-------|
41| `KEY_VAULT_URL` | `https://{vault-name}.vault.azure.net/` |
42| `KEY_VAULT_NAME` | Vault name |
43 
44## Best Practices
45 
461. **Always use RBAC** over access policies
472. **Enable soft delete and purge protection** for production
483. **Use managed identities** instead of storing keys in apps
494. **Set expiration dates** on secrets
505. **Use separate vaults** for different environments
51 
52## References
53 
54- [Bicep Patterns](bicep.md)
55- [SDK Access](sdk.md)
56