Azurator

Azurator rotates shared-key credentials for Azure services and updates supported places where they are stored.

First rotation

The simplest workflow starts with an existing dotenv file:

azurator login
azurator rotate --env-file .env

Azurator matches the file values to supported Azure keys, displays every planned change, asks once for confirmation, rotates those keys, and updates the file plus supported Azure configuration that stores them.

Pre-alpha software

Rotation changes live Azure keys and cannot be rolled back. Review the displayed changes before confirming them.

Start here

1. Install Azurator
2. Sign in to Azure
3. Run your first rotation

Other workflows

• Rotate a SOPS file without writing decrypted content to disk.
• Export or refresh keys in a plaintext or SOPS-encrypted dotenv file.
• Resume a rotation after a failure or interruption.
• Choose keys interactively without providing a file.

Before choosing shared keys

Shared keys are useful for prototypes and existing integrations, but they must be stored, distributed, and rotated. Prefer Microsoft Entra ID when the service and workload support it. Use Azurator when shared keys remain the practical choice.

Microsoft provides guidance for secretless authentication, Foundry authentication, and Azure Storage Shared Key.

See Supported Key Resources and Bindings for Azurator’s exact current coverage.