Key Vaults Enumeration

List all Key Vaults in the subscription

az keyvault list
az keyvault list -o table
az keyvault list --resource-group $RESOURCE_GROUP --query "[].{Name:name, URI:properties.vaultUri, Public:properties.publicNetworkAccess, 
RBAC_Off:properties.enableRbacAuthorization, PolicyCount:length(properties.accessPolicies || '[]')}" --output table

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.KeyVault/vaults?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN" \
  --query "value[].name" -o tsv

Check access policies (who has what permissions)

az keyvault show --name $KEYVAULT_NAME --query "properties.accessPolicies[].{OID:objectId, Permissions:permissions.secrets}"

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$VAULT_NAME?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN" \
  --query "properties.accessPolicies[].{OID:objectId, Permissions:permissions.secrets}"

List Key Vaults in a specific Resource Group

az keyvault list --resource-group $RESOURCE_GROUP

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN" \
  --query "value[].name" -o tsv

Show details of a specific Key Vault

az keyvault show --name $VAULT_NAME

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$VAULT_NAME?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN"

List all keys in a Key Vault

az keyvault key list --vault-name $KEYVAULT_NAME

Using a token

az rest --method GET \
  --url "https://$VAULT_NAME.vault.azure.net/keys?api-version=7.4" \
  --headers "Authorization=Bearer $VAULT_TOKEN" \
  --query "value[].kid" -o tsv

List all secrets in a Key Vault

az keyvault secret list --vault-name $KEYVAULT_NAME

Using a token

az rest --method GET \
  --url "https://$VAULT_NAME.vault.azure.net/secrets?api-version=7.4" \
  --headers "Authorization=Bearer $VAULT_TOKEN" \
  --query "value[].id" -o tsv

List all certificates in a Key Vault

az keyvault certificate list --vault-name $KEYVAULT_NAME

Using a token

az rest --method GET \
  --url "https://$VAULT_NAME.vault.azure.net/certificates?api-version=7.4" \
  --headers "Authorization=Bearer $VAULT_TOKEN" \
  --query "value[].id" -o tsv

List all deleted Key Vaults in the subscription

az keyvault list-deleted

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.KeyVault/deletedVaults?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN" \
  --query "value[].name" -o tsv

Get properties of a deleted Key Vault

az keyvault show-deleted --name $KEYVAULT_NAME

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.KeyVault/locations/$LOCATION/deletedVaults/$VAULT_NAME?api-version=2023-07-01" \
  --headers "Authorization=Bearer $ARM_TOKEN"

Get assigned roles

az role assignment list --include-inherited --scope "/subscriptions/<subscription-uuid>/resourceGroups/$RESOURCE_GROUP$/providers/Microsoft.KeyVault/vaults/$KEYVAULT_NAME"

Using a token

az rest --method GET \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/$VAULT_NAME/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&\$filter=atScope()" \
  --headers "Authorization=Bearer $ARM_TOKEN"

List deleted secrets

az keyvault secret list-deleted --vault-name $KEYVAULT_NAME

Using a token

az rest --method GET \
  --url "https://$VAULT_NAME.vault.azure.net/deletedsecrets?api-version=7.4" \
  --headers "Authorization=Bearer $VAULT_TOKEN" \
  --query "value[].id" -o tsv