Struct AzureKeyVaultProvider 

pub struct AzureKeyVaultProvider { /* private fields */ }

Azure Key Vault Column Master Key provider.

This provider implements the KeyStoreProvider trait to support Always Encrypted operations using keys stored in Azure Key Vault.

Thread Safety

This provider is Send + Sync and can be safely shared across threads.

Implementations

impl AzureKeyVaultProvider

pub fn new() -> Result<Self, EncryptionError>

Create a new Azure Key Vault provider with default credentials.

This uses DeveloperToolsCredential which tries multiple authentication methods in order:

1. Azure CLI credentials (az login)
2. Other developer tools (Visual Studio Code, etc.)

For production environments, use Self::with_credential with a specific credential type such as managed identity or service principal.

Errors

Returns an error if credential initialization fails.

Example

let provider = AzureKeyVaultProvider::new()?;

pub fn with_credential(credential: Arc<DeveloperToolsCredential>) -> Self

Create a new Azure Key Vault provider with an existing credential.

Use this when you need to share a credential across multiple providers.

Example

use azure_identity::DeveloperToolsCredential;

let credential = Arc::new(DeveloperToolsCredential::new(None)?);
let provider = AzureKeyVaultProvider::with_credential(credential);

pub fn with_trusted_endpoints<I, S>(self, suffixes: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Override the set of host suffixes a server-supplied CMK path may target.

By default only Microsoft-operated Key Vault / Managed HSM endpoints (.vault.azure.net, .managedhsm.azure.net, and the China / US-Gov / legacy-Germany variants) are accepted, so a malicious server cannot redirect key operations to an attacker-controlled host. Use this only for private or sovereign deployments with custom DNS, and pass suffixes you fully control (e.g. ".vault.contoso.example"). Replacing the list with an over-broad suffix re-opens the SSRF / token-exfiltration vector this guard closes.

Trait Implementations

impl Debug for AzureKeyVaultProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyStoreProvider for AzureKeyVaultProvider

fn provider_name(&self) -> &str

Returns the provider name as used in SQL Server metadata.

fn decrypt_cek<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, cmk_path: &'life1 str, algorithm: &'life2 str, encrypted_cek: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EncryptionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Decrypt a Column Encryption Key (CEK) using the Column Master Key (CMK).

fn sign_data<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, cmk_path: &'life1 str, data: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EncryptionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Sign data using the Column Master Key (optional).

fn verify_signature<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, cmk_path: &'life1 str, data: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<bool, EncryptionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Verify a signature (optional).