Exercise - Manage secrets with Azure Key Vault

Why it matters

Agents and their tools still need API keys and connection strings; where those come from and how a new version reaches a running process decide whether rotation breaks anything.

What to practise

Deploy a Key Vault preloaded with sample secrets, assign your account the Key Vault Secrets Officer role, and complete a Flask app with the Azure SDK. Retrieve secrets with get_secret() and inspect their metadata, list properties with list_properties_of_secrets() without exposing values, and write a new version with set_secret() to simulate rotation. Last, add a 30-second in-memory cache and watch which reads go to the vault.

How it fits

This is a general-purpose Key Vault exercise; the app is background. What matters for an agent is the retrieval API and the role: Secrets Officer can also write, which 4.1.6 separates from runtime read access. The cache lifetime against a new secret version is 4.1.7’s adoption question. The exercise covers secrets, not certificates.