keyvault.py

import sys
import argparse
from azure.keyvault import KeyVaultClient
from azure.common.credentials import get_azure_cli_credentials
from msrestazure.azure_active_directory import MSIAuthentication

parser = argparse.ArgumentParser(
    description=
    'Script to retrieve azure keyvault secret using Microsoft MSI or Azure.Cli authentication'
)
parser.add_argument(
    '--keyvault-uri',
    type=str,
    help='KeyVault URL/URI such as : https://<yourkeyvault>.vault.azure.net/',
    required=True,
    dest="keyvaulturi")
parser.add_argument('--keyvault-secretname',
                    type=str,
                    help='KeyVault Secret Name',
                    required=True,
                    dest="secretname")
parser.add_argument(
    '--keyvault-secretversion',
    type=str,
    help='KeyVault Secret Version, if not specified defaults to latest',
    required=False,
    default="",
    dest="secretversion")
args = parser.parse_args(args=None if sys.argv[1:] else ['--help'])


def get_key_vault_credentials():
    try:
        return MSIAuthentication(resource='https://vault.azure.net')
    except:
        credentials, subscription_id = get_azure_cli_credentials(
            resource="https://vault.azure.net")
        return credentials


def get_keyvault_secret():
    key_vault_client = KeyVaultClient(get_key_vault_credentials())
    secret = key_vault_client.get_secret(args.keyvaulturi, args.secretname,
                                         args.secretversion)
    return secret.value


print(get_keyvault_secret())