AzVaultCopy

Cli tool to export and import secrets and certs from one Key Vault to another, either on same Entra Tenant or across 2 different Tenants

Features

• exports not only latest objects, but also all older versions
• Displays a detailed report of export or import statuses
• save to local while import - supports exporting all versions of certs and secrets onto local drive, while importing to destination vault
• export only -[ supports exporting objects to local drive only and skip importing to destination vault

Limitations & Unsupported Scenario

objects = certs and secrets

• Windows only
• cannot import expired objects
• cannot export disabled objects
• Cert that is marked Not Exportable cannot be imported due to missing private-key.

Usage

1. pip install azvaultcopy

2. Authentication (repeat 2.1 and 2.2 if destination vault is in a different Entra Tenant)

   2.1 sign in using either
   - Azure user account az login --tenant {tenant id}
   - service principal az login --service-principal -u -p --tenant {tenant id}

   2.2 get access token:
   az account get-access-token --scope https://vault.azure.net/.default --query "accessToken"

3. Authorization - user account or service principal requires following Azure RBAC

   • Key Vault Reader
   • Key Vault Secrets User

4. azvaultcopy copypaste --src_vault {name of source key vault} --dest_vault {name of dest key vault} --src_token {source vault tenant access token} --dest_token {dest vault tenant access token}

args	type	description
-sv, --src_vault	TEXT	source vault name
-dv, --dest_vault	TEXT	destination vault name
-st, --src_token	TEXT	access token of source Entra Tenant to access source vault
-dt, --dest_token	TEXT	TEXT
-ed, --export_dir	TEXT	TEXT
-eo, --export_only	TEXT	TEXT
-ii, --no_import_if_dest_exist	TEXT	any cert or secret with same name at dest vault will not be imported
--help		help

Report