---
layout: docs
page_title: Azure Key Vault configuration
description: >-
  Learn about using the Azure Key Vault KMS for key management and configuring parameters and authentication. View an example azurekeyvault configuration.
---

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
> [!IMPORTANT]  
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️

# `azurekeyvault` KMS

The Azure Key Vault KMS configures Boundary to use Azure Key Vault for key management.
The Azure Key Vault KMS is activated by one of the following:

- The presence of a `seal "azurekeyvault"` block in Boundary's configuration file.

## `azurekeyvault` example

This example shows configuring Azure Key Vault KMS through the Boundary
configuration file by providing all the required values:

```hcl
kms "azurekeyvault" {
  purpose        = "root"
  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
  client_secret  = "DUJDS3..."
  vault_name     = "hc-vault"
  key_name       = "vault_key"
  key_id         = "global_worker-auth"
}
```

## `azurekeyvault` parameters

These parameters apply to the `kms` stanza in the Vault configuration file:

- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
   `root`, `previous-root`, `recovery`, `bsr`, or `config`.

- `tenant_id` `(string: <required>)`: The tenant id for the Azure Active Directory organization. May
  also be specified by the `AZURE_TENANT_ID` environment variable.

- `client_id` `(string: <required or MSI>)`: The client id for credentials to query the Azure APIs.
  May also be specified by the `AZURE_CLIENT_ID` environment variable.

- `client_secret` `(string: <required or MSI>)`: The client secret for credentials to query the Azure APIs.
  May also be specified by the `AZURE_CLIENT_SECRET` environment variable.

- `environment` `(string: "AZUREPUBLICCLOUD")`: The Azure Cloud environment API endpoints to use. May also
  be specified by the `AZURE_ENVIRONMENT` environment variable.

- `vault_name` `(string: <required>)`: The Key Vault vault to use the encryption keys for encryption and
  decryption. May also be specified by the `AZUREKEYVAULT_WRAPPER_VAULT_NAME` environment variable.

- `key_name` `(string: <required>)`: The Key Vault key to use for encryption and decryption. May also be specified by the
  `AZUREKEYVAULT_WRAPPER_KEY_NAME` environment variable.

- `key_id` - The unique name of this key.
It is used to identify the key when you perform a root key migration.
You can use the `key_id` field with all KMS stanzas.

## Authentication

Authentication-related values must be provided, either as environment
variables or as configuration parameters.

Azure authentication values:

- `AZURE_TENANT_ID`
- `AZURE_CLIENT_ID`
- `AZURE_CLIENT_SECRET`
- `AZURE_ENVIRONMENT`
