hexasync.dataprotection.azurekeyvault

Azure Key Vault KEK-custody adapter for hexasync.dataprotection. Wraps/unwraps DEKs via Key Vault (the KEK never leaves the vault), version-pinned so DEKs stay unwrappable across KEK rotations, and secretless (DefaultAzureCredential / Workload Identity). The Azure SDK is isolated to this package; the core library has no Azure dependency.

Configuration (flat DATA_PROTECTION_* env vars)

House convention: flat UPPER_SNAKE_CASE env vars (no appsettings.json), mapped via [ConfigurationKeyName].

DATA_PROTECTION_KEK_PROVIDER=AzureKeyVault              # switch custody to KV (core setting)
DATA_PROTECTION_KV_VAULT_URI=https://my-vault.vault.azure.net/
DATA_PROTECTION_KV_KEY_NAME=hexasync-kek
DATA_PROTECTION_KV_ALLOW_LOCAL_CREDENTIALS=false        # true only for local dev against a real vault

kek_id is the KV key version (e.g. .../keys/hexasync-kek/<version>) — recorded per DEK so each stays unwrappable under the exact version that wrapped it, even after the vault's current version rotates.

Wiring

services.AddDbContextFactory<MyDbContext>(o => o.UseNpgsql(cs));
services.AddHexaSyncDataProtectionWithEf<MyDbContext>(configuration);   // Provider=AzureKeyVault → registers NO local wrapper
services.AddAzureKeyVaultKeyWrapper(configuration);                     // supplies the KV IKeyWrapper

• Order-independent relative to AddHexaSyncDataProtection for the AzureKeyVault provider (it registers no wrapper, so the KV one fills the seam either way).
• Do NOT mix with Provider=Local. AddAzureKeyVaultKeyWrapper throws if an IKeyWrapper is already registered — a Local provider registers one, so combining them is a fail-fast configuration error, not a silent override.

Credentials

Uses DefaultAzureCredential (Workload Identity on AKS / federated identity elsewhere) — no secrets in config. The identity needs Key Vault wrap/unwrap (and get for version resolution) on the KEK. Environment-credential fallback is excluded unless AllowLocalCredentials is set (local dev only).

Operations

KEK-retention (never delete a KEK version while any non-destroyed DEK records it, never faster than backups age out), compromise/rotation, and the fleet re-wrap burst budget are in the core repo's ops runbook: docs/data-protection/OPS_RUNBOOK.md.