Skip to content

Update readme CLI snippets #7384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chlowell merged 1 commit into from
Sep 30, 2019
Merged

Update readme CLI snippets #7384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 36 additions & 28 deletions sdk/keyvault/azure-keyvault-certificates/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,21 +19,27 @@ pip install azure-keyvault-certificates
```

### Prerequisites
* An [Azure subscription][azure_sub].
* Python 2.7, 3.5.3, or later to use this package.
* A Key Vault. If you need to create a Key Vault, you can use the [Azure Cloud Shell][azure_cloud_shell] to create one with this Azure CLI command.
Replace `<your-resource-group-name>` and `<your-key-vault-name>` with your own unique names:

* An [Azure subscription][azure_sub]
* Python 2.7, 3.5.3, or later
* A Key Vault. If you need to create one, you can use the
[Azure Cloud Shell][azure_cloud_shell] to create one with these commands
(replace `"my-resource-group"` and `"my-key-vault"` with your own, unique
names):
* (Optional) if you want a new resource group to hold the Key Vault:
```sh
az group create --name my-resource-group --location westus2
```
* Create the Key Vault:
```Bash
az keyvault create --resource-group <your resource group name> --name <your key vault name>
az keyvault create --resource-group my-resource-group --name my-key-vault
```

Output:
```json
{
"id": "...",
"location": "westus2",
"name": "<your key vault name>",
"name": "my-key-vault",
"properties": {
"accessPolicies": [...],
"createMode": null,
Expand All @@ -46,44 +52,46 @@ pip install azure-keyvault-certificates
"provisioningState": "Succeeded",
"sku": { "name": "standard" },
"tenantId": "...",
"vaultUri": "https://<your key vault name>.vault.azure.net/"
"vaultUri": "https://my-key-vault.vault.azure.net/"
},
"resourceGroup": "<your resource group name>",
"resourceGroup": "my-resource-group",
"type": "Microsoft.KeyVault/vaults"
}
```

> The `"vaultUri"` property is the `vault_url` used by `CertificateClient`.
> The `"vaultUri"` property is the `vault_url` used by `CertificateClient`

### Authenticate the client
In order to interact with a Key Vault's certificates, you'll need an instance of the [CertificateClient][certificate_client_docs]
class. Creating one requires a **vault url** and
**credential**. This document demonstrates using `DefaultAzureCredential` as
the credential, authenticating with a service principal's client id, secret,
and tenant id. Other authentication methods are supported. See the
[azure-identity][azure_identity] documentation for more details.

#### Create a service principal
Use this [Azure Cloud Shell][azure_cloud_shell] snippet to create a
service principal:

* Create a service principal and configure its access to Azure resources:
In order to interact with a Key Vault's certificates, you'll need an instance
of the [CertificateClient][certificate_client_docs] class. Creating one
requires a **vault url** and **credential**. This document demonstrates using
`DefaultAzureCredential` as the credential, authenticating with a service
principal's client id, secret, and tenant id. Other authentication methods are
supported. See the [azure-identity][azure_identity] documentation for more
details.

#### Create a service principal
This [Azure Cloud Shell][azure_cloud_shell] snippet shows how to create a
new service principal. Before using it, replace "your-application-name" with
a more appropriate name for your service principal.

* Create a service principal:
```Bash
az ad sp create-for-rbac -n <your-application-name> --skip-assignment
az ad sp create-for-rbac --name http://my-application --skip-assignment
```
Output:
```json
{
"appId": "generated app id",
"displayName": "your-application-name",
"name": "http://your-application-name",
"displayName": "my-application",
"name": "http://my-application",
"password": "random password",
"tenant": "tenant id"
}
```

* Use the output to set **AZURE_CLIENT_ID** (appId), **AZURE_CLIENT_SECRET**
(password), and **AZURE_TENANT_ID** (tenant) environment variables. The
* Use the output to set **AZURE_CLIENT_ID** (appId), **AZURE_CLIENT_SECRET**
(password) and **AZURE_TENANT_ID** (tenant) environment variables. The
following example shows a way to do this in Bash:
```Bash
export AZURE_CLIENT_ID="generated app id"
Expand All @@ -93,7 +101,7 @@ following example shows a way to do this in Bash:

* Authorize the service principal to perform certificate operations in your Key Vault:
```Bash
az keyvault set-policy --name <your-key-vault-name> --spn $AZURE_CLIENT_ID --certificate-permissions backup create delete get import list purge recover restore update
az keyvault set-policy --name my-key-vault --spn $AZURE_CLIENT_ID --certificate-permissions backup create delete get import list purge recover restore update
```
> Possible certificate permissions: backup, create, delete, deleteissuers, get, getissuers, import, list, listissuers, managecontacts, manageissuers, purge, recover, restore, setissuers, update

Expand Down
36 changes: 21 additions & 15 deletions sdk/keyvault/azure-keyvault-keys/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,21 +22,26 @@ pip install azure-keyvault-keys

### Prerequisites
* An [Azure subscription][azure_sub]
* Python 2.7, 3.5 or later
* Python 2.7, 3.5.3, or later
* A Key Vault. If you need to create one, you can use the
[Azure Cloud Shell][azure_cloud_shell] to create one with this command (replace
`<your resource group name>` and `<your key vault name>` with your own, unique
[Azure Cloud Shell][azure_cloud_shell] to create one with these commands
(replace `"my-resource-group"` and `"my-key-vault"` with your own, unique
names):
* (Optional) if you want a new resource group to hold the Key Vault:
```sh
az group create --name my-resource-group --location westus2
```
* Create the Key Vault:
```Bash
az keyvault create --resource-group <your resource group name> --name <your key vault name>
az keyvault create --resource-group my-resource-group --name my-key-vault
```

Output:
```json
{
"id": "...",
"location": "westus2",
"name": "<your key vault name>",
"name": "my-key-vault",
"properties": {
"accessPolicies": [...],
"createMode": null,
Expand All @@ -49,9 +54,9 @@ names):
"provisioningState": "Succeeded",
"sku": { "name": "standard" },
"tenantId": "...",
"vaultUri": "https://<your key vault name>.vault.azure.net/"
"vaultUri": "https://my-key-vault.vault.azure.net/"
},
"resourceGroup": "<your resource group name>",
"resourceGroup": "my-resource-group",
"type": "Microsoft.KeyVault/vaults"
}
```
Expand All @@ -66,20 +71,21 @@ the credential, authenticating with a service principal's client id, secret,
and tenant id. Other authentication methods are supported. See the
[azure-identity][azure_identity] documentation for more details.

#### Create a service principal
Use this [Azure Cloud Shell][azure_cloud_shell] snippet to create a
service principal:
#### Create a service principal
This [Azure Cloud Shell][azure_cloud_shell] snippet shows how to create a
new service principal. Before using it, replace "your-application-name" with
a more appropriate name for your service principal.

* Create a service principal and configure its access to Azure resources:
* Create a service principal:
```Bash
az ad sp create-for-rbac -n <your-application-name> --skip-assignment
az ad sp create-for-rbac --name http://my-application --skip-assignment
```
Output:
```json
{
"appId": "generated app id",
"displayName": "your-application-name",
"name": "http://your-application-name",
"displayName": "my-application",
"name": "http://my-application",
"password": "random password",
"tenant": "tenant id"
}
Expand All @@ -96,7 +102,7 @@ following example shows a way to do this in Bash:

* Authorize the service principal to perform key operations in your Key Vault:
```Bash
az keyvault set-policy --name <your key vault name> --spn $AZURE_CLIENT_ID --key-permissions backup delete get list create
az keyvault set-policy --name my-key-vault --spn $AZURE_CLIENT_ID --key-permissions backup delete get list create
```
> Possible key permissions:
> - Key management: backup, delete, get, list, purge, recover, restore, create, update, import
Expand Down
38 changes: 22 additions & 16 deletions sdk/keyvault/azure-keyvault-secrets/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,21 +22,26 @@ pip install azure-keyvault-secrets

### Prerequisites
* An [Azure subscription][azure_sub]
* Python 2.7, 3.5 or later
* Python 2.7, 3.5.3, or later
* A Key Vault. If you need to create one, you can use the
[Azure Cloud Shell][azure_cloud_shell] to create one with this command (replace
`<your resource group name>` and `<your key vault name>` with your own, unique
[Azure Cloud Shell][azure_cloud_shell] to create one with these commands
(replace `"my-resource-group"` and `"my-key-vault"` with your own, unique
names):
* (Optional) if you want a new resource group to hold the Key Vault:
```sh
az group create --name my-resource-group --location westus2
```
* Create the Key Vault:
```Bash
az keyvault create --resource-group <your resource group name> --name <your key vault name>
az keyvault create --resource-group my-resource-group --name my-key-vault
```

Output:
```json
{
"id": "...",
"location": "westus2",
"name": "<your key vault name>",
"name": "my-key-vault",
"properties": {
"accessPolicies": [...],
"createMode": null,
Expand All @@ -49,14 +54,14 @@ names):
"provisioningState": "Succeeded",
"sku": { "name": "standard" },
"tenantId": "...",
"vaultUri": "https://<your key vault name>.vault.azure.net/"
"vaultUri": "https://my-key-vault.vault.azure.net/"
},
"resourceGroup": "<your resource group name>",
"resourceGroup": "my-resource-group",
"type": "Microsoft.KeyVault/vaults"
}
```

> The `"vaultUri"` property is the `vault_url` used by `SecretClient`.
> The `"vaultUri"` property is the `vault_url` used by `SecretClient`

### Authenticate the client
In order to interact with a Key Vault's secrets, you'll need an instance of the
Expand All @@ -66,20 +71,21 @@ the credential, authenticating with a service principal's client id, secret,
and tenant id. Other authentication methods are supported. See the
[azure-identity][azure_identity] documentation for more details.

#### Create a service principal
Use this [Azure Cloud Shell][azure_cloud_shell] snippet to create a
service principal:
#### Create a service principal
This [Azure Cloud Shell][azure_cloud_shell] snippet shows how to create a
new service principal. Before using it, replace "your-application-name" with
a more appropriate name for your service principal.

* Create a service principal and configure its access to Azure resources:
* Create a service principal:
```Bash
az ad sp create-for-rbac -n <your-application-name> --skip-assignment
az ad sp create-for-rbac --name http://my-application --skip-assignment
```
Output:
```json
{
"appId": "generated app id",
"displayName": "your-application-name",
"name": "http://your-application-name",
"displayName": "my-application",
"name": "http://my-application",
"password": "random password",
"tenant": "tenant id"
}
Expand All @@ -96,7 +102,7 @@ following example shows a way to do this in Bash:

* Authorize the service principal to perform key operations in your Key Vault:
```Bash
az keyvault set-policy --name <your key vault name> --spn $AZURE_CLIENT_ID --key-permissions backup delete get list create
az keyvault set-policy --name my-key-vault --spn $AZURE_CLIENT_ID --key-permissions backup delete get list create
```
> Possible key permissions:
> - Key management: backup, delete, get, list, purge, recover, restore, create, update, import
Expand Down