Share via

az keyvault security-domain

Manage security domain operations.

Commands

Name Description Type Status
az keyvault security-domain download

Download the security domain file from the HSM.

 Core GA
az keyvault security-domain init-recovery

Retrieve the exchange key of the HSM.

 Core GA
az keyvault security-domain restore-blob

Enable to decrypt and encrypt security domain file as blob. Can be run in offline environment, before file is uploaded to HSM using security-domain upload.

 Core GA
az keyvault security-domain upload

Start to restore the HSM.

 Core GA
az keyvault security-domain wait

Place the CLI in a waiting state until HSM security domain operation is finished.

 Core GA

az keyvault security-domain download

Edit

Download the security domain file from the HSM.

az keyvault security-domain download --sd-quorum
                                     --sd-wrapping-keys
                                     --security-domain-file
                                     [--hsm-name]
                                     [--id]
                                     [--no-wait]

Examples

Security domain download (N=3, M=2).

az keyvault security-domain download --hsm-name MyHSM --security-domain-file "{SD_FILE_NAME}" --sd-quorum 2 --sd-wrapping-keys "{PEM_PUBLIC_KEY1_FILE_NAME}" "{PEM_PUBLIC_KEY2_FILE_NAME}" "{PEM_PUBLIC_KEY3_FILE_NAME}"

Required Parameters

--sd-quorum

The minimum number of shares required to decrypt the security domain for recovery.

--sd-wrapping-keys

Space-separated file paths to PEM files containing public keys.

--security-domain-file

Path to a file where the JSON blob returned by this command is stored.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

Property Value
Parameter group: HSM Id Arguments
--id

Full URI of the HSM.

Property Value
Parameter group: HSM Id Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az keyvault security-domain init-recovery

Edit

Retrieve the exchange key of the HSM.

az keyvault security-domain init-recovery --sd-exchange-key
                                          [--hsm-name]
                                          [--id]

Examples

Retrieve the exchange key and store it.

az keyvault security-domain init-recovery --hsm-name MyHSM --sd-exchange-key "{PATH_TO_RESTORE}"

Required Parameters

--sd-exchange-key

Local file path to store the exported key.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

Property Value
Parameter group: HSM Id Arguments
--id

Full URI of the HSM.

Property Value
Parameter group: HSM Id Arguments
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az keyvault security-domain restore-blob

Edit

Enable to decrypt and encrypt security domain file as blob. Can be run in offline environment, before file is uploaded to HSM using security-domain upload.

az keyvault security-domain restore-blob --sd-exchange-key
                                         --sd-file
                                         --sd-file-restore-blob
                                         --sd-wrapping-keys
                                         [--passwords]

Examples

Security domain restore blob.

az keyvault security-domain restore-blob --sd-file "{SD_TRANSFER_FILE}" --sd-exchange-key "{PEM_FILE_NAME}" --sd-wrapping-keys "{PEM_PRIVATE_KEY1_FILE_NAME}" "{PEM_PRIVATE_KEY2_FILE_NAME}" --sd-file-restore-blob "{SD_TRANSFER_FILE_RESTORE_BLOB}"

Required Parameters

--sd-exchange-key

The exchange key for security domain.

--sd-file

This file contains security domain encrypted using SD Exchange file downloaded in security-domain init-recovery command.

--sd-file-restore-blob

Local file path to store the security domain encrypted with the exchange key.

--sd-wrapping-keys

Space-separated file paths to PEM files containing private keys.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--passwords

Space-separated password list for --sd-wrapping-keys. CLI will match them in order. Can be omitted if your keys are without password protection.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az keyvault security-domain upload

Edit

Start to restore the HSM.

az keyvault security-domain upload --sd-file
                                   [--hsm-name]
                                   [--id]
                                   [--no-wait]
                                   [--passwords]
                                   [--restore-blob]
                                   [--sd-exchange-key]
                                   [--sd-wrapping-keys]

Examples

Security domain upload (M=2).

az keyvault security-domain upload --hsm-name MyHSM --sd-file "{SD_TRANSFER_FILE}" --sd-exchange-key "{PEM_FILE_NAME}" --sd-wrapping-keys "{PEM_PRIVATE_KEY1_FILE_NAME}" "{PEM_PRIVATE_KEY2_FILE_NAME}"

Security domain upload, in which sd_file is already restored using keyvault security-domain restore-blob command

az keyvault security-domain upload --hsm-name MyHSM --sd-file "{SD_TRANSFER_FILE}" --restore-blob

Required Parameters

--sd-file

This file contains security domain encrypted using SD Exchange file downloaded in security-domain init-recovery command.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

Property Value
Parameter group: HSM Id Arguments
--id

Full URI of the HSM.

Property Value
Parameter group: HSM Id Arguments
--no-wait

Do not wait for the long-running operation to finish.

Property Value
Default value: False
--passwords

Space-separated password list for --sd-wrapping-keys. CLI will match them in order. Can be omitted if your keys are without password protection.

--restore-blob

Indicator if blob is already restored.

Property Value
Default value: False
--sd-exchange-key

The exchange key for security domain.

--sd-wrapping-keys

Space-separated file paths to PEM files containing private keys.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az keyvault security-domain wait

Edit

Place the CLI in a waiting state until HSM security domain operation is finished.

az keyvault security-domain wait [--hsm-name]
                                 [--id]
                                 [--target-operation {download, restore_blob, upload}]

Examples

Pause CLI until the security domain operation is finished.

az keyvault security-domain wait --hsm-name MyHSM

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--hsm-name

Name of the HSM. Can be omitted if --id is specified.

Property Value
Parameter group: HSM Id Arguments
--id

Full URI of the HSM.

Property Value
Parameter group: HSM Id Arguments
--target-operation

Target operation that needs waiting.

Property Value
Default value: upload
Accepted values: download, restore_blob, upload
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False