Supported Key Resources and Bindings
Azurator supports a defined set of shared-key credentials and configuration that stores them. It does not scan every secret in a subscription.
Show the types supported by your installed version:
azurator listUse --key-resources or --bindings to show one category. This command does
not sign in or contact Azure. Use azurator discover to list actual supported
key resources in the selected subscription.
Key resources
Section titled “Key resources”A key resource is the Azure resource that owns a supported key pair.
| Azure key resource | Slots | Discovery | Retrieval and rotation |
|---|---|---|---|
| Storage Account | key1, key2 |
Supported | Supported when Shared Key authentication is enabled. |
| Azure AI, Cognitive Services, or Azure OpenAI resource | Key1, Key2 |
Supported | Supported when local key authentication is enabled. |
discover shows key authentication as enabled or disabled. Disabled key
resources remain visible, but their slots are not offered for export, refresh,
planning, or rotation.
An enabled state does not prove that the signed-in identity can retrieve or rotate keys. Discovery does not test those later permissions.
Credential bindings
Section titled “Credential bindings”A credential binding is a separate configuration entry that stores a key, either as a raw value or in a supported structured value. A consumer or workload is a running application, deployment, model, or process that reads a binding. Finding a binding does not prove active workload use.
Azurator can update these bindings:
| Location | Binding |
|---|---|
| Local | Matched raw keys or supported Storage Shared Key connection strings in one selected plaintext dotenv file. |
| Local | The same top-level values in one selected SOPS-encrypted dotenv file. |
| Azure | Public-cloud, project-level Foundry AzureStorageAccount connections using AccountKey. |
| Azure | Public-cloud, project-level Foundry AzureOpenAI connections using ApiKey. |
| Azure | Raw keys or supported Storage Shared Key connection strings in application settings on visible top-level App Service apps. |
Foundry inspection identifies a stored connection record below a project. It does not prove that the project, a deployment, or a model actively uses it.
For App Service, Azurator reads the complete application-settings dictionary and keeps only supported matches. This includes Function Apps because they use the same top-level Azure resource and application-settings API. Updating a dictionary restarts the app. Do not run concurrent settings edits or deployments. Deployment slots and App Service’s separate connection-string collection are not inspected.
The supported Storage connection-string form contains AccountName and
AccountKey, plus the documented endpoint fields. Azurator matches it only to
the named Storage Account and replaces only AccountKey. SAS, the
UseDevelopmentStorage=true Azurite shortcut, identity-based, malformed, and
arbitrary embedded values are not parsed.
Azurator verifies binding values after every update. It does not invoke models, read application data, reload workloads, or perform health checks.
No listed binding means only that Azurator found no match among the binding types above. It does not prove that no other configuration or running workload uses the key.
Export and refresh
Section titled “Export and refresh”azurator export can create one new private dotenv file containing selected
retrievable Storage or Azure AI key slots. --out creates plaintext.
--sops-out encrypts and verifies the document through SOPS without writing
plaintext to disk. Neither mode overwrites an existing file.
azurator refresh uses a key map to replace mapped values in one existing
plaintext or SOPS dotenv file. It preserves unmapped assignment values and never
adds a missing selector. Plaintext refresh also preserves the remaining file
content. An existing supported Storage connection string keeps its other fields
and receives the current AccountKey. Exported values remain raw keys. Refresh
reads current keys but does not rotate them or update Azure-side bindings.
Not supported
Section titled “Not supported”- universal Azure secret discovery
- Microsoft Entra application client secrets
- SAS tokens, passwords, certificates, and values Azure cannot retrieve after creation
- unsupported Foundry connection types or scopes
- App Service deployment slots, its separate connection-string collection, and unsupported embedded values
- Key Vault references, Container Apps, Kubernetes, pipelines, and arbitrary application configuration
- workload reloads and health checks
If Azurator finds a relevant binding it cannot update and verify safely, it blocks the rotation instead of leaving that binding on the old key.
Permissions
Section titled “Permissions”Key-resource discovery, key access, rotation, and binding updates are separate Azure operations. The signed-in identity needs the permissions used by the requested workflow at the narrowest practical scope.
| Azurator operation | Azure permissions used |
|---|---|
| Discover Storage Accounts | Microsoft.Storage/storageAccounts/read |
| Read Storage keys | Microsoft.Storage/storageAccounts/listkeys/action |
| Rotate a Storage key | Microsoft.Storage/storageAccounts/regeneratekey/action |
| Discover Azure AI accounts | Microsoft.CognitiveServices/accounts/read |
| Read Azure AI keys | Microsoft.CognitiveServices/accounts/listKeys/action |
| Rotate an Azure AI key | Microsoft.CognitiveServices/accounts/regenerateKey/action |
| Inspect Foundry projects and connections | Microsoft.CognitiveServices/accounts/projects/read, Microsoft.CognitiveServices/accounts/projects/connections/read, and Microsoft.CognitiveServices/accounts/projects/connections/listsecrets/action |
| Update a Foundry connection | Microsoft.CognitiveServices/accounts/projects/connections/write plus Foundry data-plane access |
| Inspect App Service settings | Microsoft.Web/sites/read and Microsoft.Web/sites/config/list/action |
| Update App Service settings | Microsoft.Web/sites/config/write |
Foundry connection access also requires the Foundry User role or equivalent Foundry data-plane permissions. Azure Owner or Contributor grants broad control- plane access but does not by itself grant Foundry data-plane access.
See Microsoft’s permission references for Storage management, AI and Cognitive Services, Foundry RBAC, and App Service configuration. Missing access blocks the affected operation and is never treated as a successful no-match.