Export and Refresh Keys

azurator export creates one new dotenv file from selected key slots or a saved key map. Choose plaintext or SOPS encryption through the output option.

Choose the output

Create a SOPS-encrypted dotenv file without writing plaintext to disk:

azurator export --sops-out azure-keys.enc.env

SOPS 3.13.x must have a creation rule or environment configuration for the destination and an identity that can decrypt the result. Azurator encrypts and decrypts the generated document in memory to verify every assignment before it creates the ciphertext file. Environment selector names and SOPS metadata remain visible in the encrypted dotenv format.

Create an explicitly plaintext dotenv file with:

azurator export --out azure-keys.env

Plaintext export

Files created with --out contain live Azure keys in plaintext. Protect them as secrets and remove them when they are no longer needed.

Select keys interactively

Azurator shows retrievable slots from supported key resources. Accounts with key authentication disabled are omitted. Before retrieving values, it displays the complete resource, slot, and generated variable mapping and asks for confirmation.

Select keys in a script

Use a complete top-level ARM resource ID followed by its exact slot:

azurator export \
  --select '/subscriptions/<subscription-id>/resourceGroups/<group>/providers/Microsoft.Storage/storageAccounts/<account>#key1' \
  --sops-out azure-keys.enc.env

Repeat --select for multiple slots. Storage uses key1 and key2. Azure AI and Cognitive Services use Key1 and Key2.

Select every retrievable slot from supported key resources with:

azurator export --all --sops-out azure-keys.enc.env

--all remains limited to the selected subscription and supported key-resource types. It does not mean every secret in Azure.

Reuse selector mappings

Create a file and its reusable key map together:

azurator export \
  --sops-out azure-keys.enc.env \
  --key-map-out azurator.keys.json

The map records the displayed selector, Azure resource, and slot for every exported assignment. It contains no key values and can drive a later refresh.

If the file already exists without a map, derive one from confirmed matches:

azurator match --sops-file secrets.enc.env --key-map-out azurator.keys.json

Plaintext files use --env-file instead. The map records each matched selector, complete ARM resource ID, and exact slot. It contains no key values, source path, or fingerprints.

Use it to recreate those assignments with the current Azure values:

azurator export --key-map azurator.keys.json --sops-out recreated.enc.env
azurator export --key-map azurator.keys.json --out recreated.env

Export includes exactly the mappings in the file. It preserves several selector aliases for one slot and does not add an unlisted sibling key. The active subscription must match the map. SOPS export still requires suitable creation rules and recipients.

A key map can be shared when its subscription ID, resource IDs, and selector names are acceptable infrastructure metadata for that repository. It cannot reconstruct unrelated values from the original dotenv file.

Refresh an existing file

Use the same key map to replace mapped values in an existing file without rotating anything:

azurator refresh --key-map azurator.keys.json --sops-file secrets.enc.env
azurator refresh --key-map azurator.keys.json --env-file secrets.env

Refresh is one-way from Azure into the file. Every selector in the map must already exist. Azurator updates stale mapped values, leaves already current values alone, and preserves assignment values not listed in the map. Plaintext refresh also preserves comments, ordering, and line endings. If a mapped selector is missing, the complete refresh stops without adding it or changing the file.

Export writes raw key values. If a refresh target already contains a supported Storage Shared Key connection string for the mapped account, refresh preserves the string and replaces only AccountKey.

SOPS refresh updates one encrypted temporary and verifies mapped and unmapped assignments before replacing the original once. It preserves the existing SOPS recipients while SOPS controls ciphertext formatting. Plaintext and SOPS refresh both ask once for confirmation unless -y is used.

Destination guarantees

Export creates the dotenv destination with mode 0600 on POSIX systems and never prints key values. Exactly one of --out and --sops-out is required. The destination must not already exist. Azurator never infers encryption from a filename and never overwrites, merges, appends, or writes exported values to stdout. --key-map-out also requires a new, distinct path and cannot be combined with --key-map. The map also uses mode 0600 on POSIX. Both outputs use the same confirmation. Cancellation and handled failures leave neither destination.

Choose one selection mode: --key-map, --select, --all, or the interactive picker. Use -y to skip the confirmation after the complete valid export intent is displayed. It does not bypass selection or destination checks.

An exported file can be matched, refreshed through a key map, or rotated later with its corresponding input option:

azurator match --env-file azure-keys.env
azurator rotate --env-file azure-keys.env
azurator match --sops-file azure-keys.enc.env
azurator rotate --sops-file azure-keys.enc.env