hexasync.dataprotection.azurekeyvault

Azure Key Vault KEK-custody adapter for hexasync.dataprotection. Wraps/unwraps DEKs via Key Vault (the KEK never leaves the vault), version-pinned so DEKs stay unwrappable across KEK rotations, and secretless (DefaultAzureCredential / Workload Identity). The Azure SDK is isolated to this package; the core library has no Azure dependency.

Configuration (flat DATA_PROTECTION_* env vars)

House convention: flat UPPER_SNAKE_CASE env vars (no appsettings.json), mapped via [ConfigurationKeyName].

DATA_PROTECTION_KEK_PROVIDER=AzureKeyVault              # switch custody to KV (core setting)
DATA_PROTECTION_KV_VAULT_URI=https://my-vault.vault.azure.net/
DATA_PROTECTION_KV_KEY_NAME=hexasync-kek
DATA_PROTECTION_KV_ALLOW_LOCAL_CREDENTIALS=false        # true only for local dev against a real vault

kek_id is the KV key version (e.g. .../keys/hexasync-kek/<version>) — recorded per DEK so each stays unwrappable under the exact version that wrapped it, even after the vault's current version rotates.

Wiring

services.AddDbContextFactory<MyDbContext>(o => o.UseNpgsql(cs));
services.AddHexaSyncDataProtectionWithEf<MyDbContext>(configuration);   // registers Local too, if a master key is set
if (!string.IsNullOrWhiteSpace(configuration["DATA_PROTECTION_KV_VAULT_URI"]))
    services.AddAzureKeyVaultKeyWrapper(configuration);                 // adds the AzureKeyVault provider

• Local and AzureKeyVault coexist. Each configured provider registers itself: Local whenever DATA_PROTECTION_MASTER_KEY_BASE64 is set, AzureKeyVault when you call AddAzureKeyVaultKeyWrapper. Registering both is not an error. DATA_PROTECTION_KEK_ACTIVE (default: DATA_PROTECTION_KEK_PROVIDER) picks the provider that wraps new and re-wrapped DEKs; unwrap routes to whichever provider wrapped a given DEK. This is the supported Local→AzureKeyVault cutover: keep both registered, flip KEK_ACTIVE, re-wrap — see the core package README ("Multiple KEK providers") and the integration guide §5b (docs/data-protection/README.md in the library repo).
• Order-independent relative to AddHexaSyncDataProtection.
• Gate the call on the vault URI. AddAzureKeyVaultKeyWrapper throws when DATA_PROTECTION_KV_VAULT_URI or DATA_PROTECTION_KV_KEY_NAME is unset, so an unconditional call breaks every environment that runs Local only.

Credentials

Uses DefaultAzureCredential (Workload Identity on AKS / federated identity elsewhere) — no secrets in config. The identity needs Key Vault wrap/unwrap (and get for version resolution) on the KEK. The environment (client-secret) credential is always excluded, so a stray AZURE_CLIENT_SECRET can never become the route to the KEK. AllowLocalCredentials (local dev only) re-enables only the developer-tool credentials — Azure CLI, Azure Developer CLI, Azure PowerShell and Visual Studio — never the environment credential.

Operations

KEK-retention (never delete a KEK version while any non-destroyed DEK records it, never faster than backups age out), compromise/rotation, and the fleet re-wrap burst budget are in the core repo's ops runbook: docs/data-protection/OPS_RUNBOOK.md.