Created on September 21, 2026

Useful AZ CLI Flows

Key Vault

list secrets

kv/list:
	@echo CERTIFICATES
	@az keyvault certificate list \
	--vault-name ${KEY_VAULT_NAME} \
	| jq -r '.[] | .name'
	@echo ""
	@echo SECRETS
	@az keyvault secret list \
	--vault-name ${KEY_VAULT_NAME} \
	| jq -r '.[] | .name'
	@echo ""

migrate secrets to another key vault

OLD_VAULT="old"
NEW_VAULT="new"
SUBSCRIPTION_NEW_VAULT="uuid"

secret_names=$( \
  az keyvault secret list \
  --vault-name "$OLD_VAULT" \
  --query '[].name' \
  --output tsv \
)

for secret_name in $secret_names; do
  echo $secret_name

  read -r -p "Copy this secret? [y/N] " answer

  case "$answer" in
    y|Y|yes|YES|Yes)
      ;;
    *)
      echo "Skipping '$secret_name'"
      continue
      ;;
  esac

  secret_json="$( \
    az keyvault secret show \
      --vault-name "$OLD_VAULT" \
      --name "$secret_name" \
      --output json \
  )"

  if [ -z "$secret_json" ]; then
    echo "ERROR: empty response for '$secret_name'" >&2
    continue
  fi

  secret_value=$(printf '%s' "$secret_json" | jq -r '.value')

  az keyvault secret set \
      --vault-name "$NEW_VAULT" \
      --subscription "$SUBSCRIPTION_NEW_VAULT" \
      --name "$secret_name" \
      --value "$secret_value" \
      --output none

done