def backup_restore_key(self):
"""
backs up a key vault key and restores it to another key vault
"""
# create a key vault
first_vault = self.create_vault()
# create a key client
credential = DefaultAzureCredential()
first_key_client = KeyClient(
vault_url=first_vault.properties.vault_uri, credential=credential)
# create a key in the vault
key_name = get_name('key')
key = first_key_client.create_key(key_name, 'RSA')
print('created key {}'.format(key.name))
# list the keys in the vault
keys = first_key_client.list_properties_of_keys()
print("keys in the first vault:")
for key in keys:
print(key.name)
# backup the key
backup = first_key_client.backup_key(key_name)
print('backed up key {}'.format(key_name))
# create a second vault
second_vault = self.create_vault()
# create a key client
second_key_client = KeyClient(
vault_url=second_vault.properties.vault_uri, credential=credential)
# restore the key to the new vault
restored = second_key_client.restore_key_backup(backup)
print('restored secret {}'.format(restored.name))
# list the keys in the new vault
keys = second_key_client.list_properties_of_keys()
print("keys in the second vault:")
for key in keys:
print(key.name)
# if the key already exists in the Key Vault, then a new version of the key is created.
print("\n.. Create Key")
key = client.create_key("keyName", "RSA")
print("Key with name '{0}' created with key type '{1}'".format(
key.name, key.key_type))
# Backups are good to have, if in case keys gets deleted accidentally.
# For long term storage, it is ideal to write the backup to a file.
print("\n.. Create a backup for an existing Key")
key_backup = client.backup_key(key.name)
print("Backup created for key with name '{0}'.".format(key.name))
# The rsa key is no longer in use, so you delete it.
print("\n.. Delete the key")
delete_operation = client.begin_delete_key(key.name)
deleted_key = delete_operation.result()
print("Deleted key with name '{0}'".format(deleted_key.name))
# Wait for the deletion to complete before purging the key.
# The purge will take some time, so wait before restoring the backup to avoid a conflict.
delete_operation.wait()
print("\n.. Purge the key")
client.purge_deleted_key(key.name)
time.sleep(60)
print("Purged key with name '{0}'".format(deleted_key.name))
# In the future, if the key is required again, we can use the backup value to restore it in the Key Vault.
print("\n.. Restore the key using the backed up key bytes")
key = client.restore_key_backup(key_backup)
print("Restored key with name '{0}'".format(key.name))
