Share via

az keyvault security-domain

  • Reference

Manage security domain operations.

Commands

Name Description Type Status
az keyvault security-domain download

Download the security domain file from the HSM.

 Core GA
az keyvault security-domain init-recovery

Retrieve the exchange key of the HSM.

 Core GA
az keyvault security-domain restore-blob

Enable to decrypt and encrypt security domain file as blob. Can be run in offline environment, before file is uploaded to HSM using security-domain upload.

 Core GA
az keyvault security-domain upload

Start to restore the HSM.

 Core GA
az keyvault security-domain wait

Place the CLI in a waiting state until HSM security domain operation is finished.

 Core GA

az keyvault security-domain download

Edit

Download the security domain file from the HSM.

az keyvault security-domain download --sd-quorum
                                     --sd-wrapping-keys
                                     --security-domain-file
                                     [--hsm-name]
                                     [--id]
                                     [--no-wait]

Examples

Security domain download (N=3, M=2).

az keyvault security-domain download --hsm-name MyHSM --security-domain-file "{SD_FILE_NAME}" --sd-quorum 2 --sd-wrapping-keys "{PEM_PUBLIC_KEY1_FILE_NAME}" "{PEM_PUBLIC_KEY2_FILE_NAME}" "{PEM_PUBLIC_KEY3_FILE_NAME}"

Required Parameters

--sd-quorum

The minimum number of shares required to decrypt the security domain for recovery.

--sd-wrapping-keys

Space-separated file paths to PEM files containing public keys.

--security-domain-file

Path to a file where the JSON blob returned by this command is stored.

Optional Parameters

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

--id

Full URI of the HSM.

--no-wait

Do not wait for the long-running operation to finish.

Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az keyvault security-domain init-recovery

Edit

Retrieve the exchange key of the HSM.

az keyvault security-domain init-recovery --sd-exchange-key
                                          [--hsm-name]
                                          [--id]

Examples

Retrieve the exchange key and store it.

az keyvault security-domain init-recovery --hsm-name MyHSM --sd-exchange-key "{PATH_TO_RESTORE}"

Required Parameters

--sd-exchange-key

Local file path to store the exported key.

Optional Parameters

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

--id

Full URI of the HSM.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az keyvault security-domain restore-blob

Edit

Enable to decrypt and encrypt security domain file as blob. Can be run in offline environment, before file is uploaded to HSM using security-domain upload.

az keyvault security-domain restore-blob --sd-exchange-key
                                         --sd-file
                                         --sd-file-restore-blob
                                         --sd-wrapping-keys
                                         [--passwords]

Examples

Security domain restore blob.

az keyvault security-domain restore-blob --sd-file "{SD_TRANSFER_FILE}" --sd-exchange-key "{PEM_FILE_NAME}" --sd-wrapping-keys "{PEM_PRIVATE_KEY1_FILE_NAME}" "{PEM_PRIVATE_KEY2_FILE_NAME}" --sd-file-restore-blob "{SD_TRANSFER_FILE_RESTORE_BLOB}"

Required Parameters

--sd-exchange-key

The exchange key for security domain.

--sd-file

This file contains security domain encrypted using SD Exchange file downloaded in security-domain init-recovery command.

--sd-file-restore-blob

Local file path to store the security domain encrypted with the exchange key.

--sd-wrapping-keys

Space-separated file paths to PEM files containing private keys.

Optional Parameters

--passwords

Space-separated password list for --sd-wrapping-keys. CLI will match them in order. Can be omitted if your keys are without password protection.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az keyvault security-domain upload

Edit

Start to restore the HSM.

az keyvault security-domain upload --sd-file
                                   [--hsm-name]
                                   [--id]
                                   [--no-wait]
                                   [--passwords]
                                   [--restore-blob]
                                   [--sd-exchange-key]
                                   [--sd-wrapping-keys]

Examples

Security domain upload (M=2).

az keyvault security-domain upload --hsm-name MyHSM --sd-file "{SD_TRANSFER_FILE}" --sd-exchange-key "{PEM_FILE_NAME}" --sd-wrapping-keys "{PEM_PRIVATE_KEY1_FILE_NAME}" "{PEM_PRIVATE_KEY2_FILE_NAME}"

Security domain upload, in which sd_file is already restored using keyvault security-domain restore-blob command

az keyvault security-domain upload --hsm-name MyHSM --sd-file "{SD_TRANSFER_FILE}" --restore-blob

Required Parameters

--sd-file

This file contains security domain encrypted using SD Exchange file downloaded in security-domain init-recovery command.

Optional Parameters

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

--id

Full URI of the HSM.

--no-wait

Do not wait for the long-running operation to finish.

Default value: False
--passwords

Space-separated password list for --sd-wrapping-keys. CLI will match them in order. Can be omitted if your keys are without password protection.

--restore-blob

Indicator if blob is already restored.

Default value: False
--sd-exchange-key

The exchange key for security domain.

--sd-wrapping-keys

Space-separated file paths to PEM files containing private keys.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az keyvault security-domain wait

Edit

Place the CLI in a waiting state until HSM security domain operation is finished.

az keyvault security-domain wait [--hsm-name]
                                 [--id]
                                 [--target-operation {download, restore_blob, upload}]

Examples

Pause CLI until the security domain operation is finished.

az keyvault security-domain wait --hsm-name MyHSM

Optional Parameters

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

--id

Full URI of the HSM.

--target-operation

Target operation that needs waiting.

Accepted values: download, restore_blob, upload
Default value: upload
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.