Metadata-Version: 2.4
Name: azurator
Version: 0.1.0a1
Summary: Rotate shared-key credentials for Azure services and update supported places where they are stored.
Author-email: "Jan T. Müller" <mail@jantmueller.com>
License-Expression: MIT
Project-URL: homepage, https://github.com/janthmueller/azurator
Project-URL: documentation, https://janthmueller.github.io/azurator/
Project-URL: source, https://github.com/janthmueller/azurator
Project-URL: tracker, https://github.com/janthmueller/azurator/issues
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: azure-ai-projects<2.4,>=2.3
Requires-Dist: azure-core<2,>=1.37
Requires-Dist: azure-identity<2,>=1.25
Requires-Dist: azure-mgmt-cognitiveservices<14.2,>=14.1
Requires-Dist: azure-mgmt-core<2,>=1.6
Requires-Dist: azure-mgmt-storage<25.2,>=25.1
Requires-Dist: azure-mgmt-web<11.1,>=11.0.1
Requires-Dist: openai<3,>=2.8
Requires-Dist: platformdirs<5,>=4.3
Requires-Dist: pydantic<3,>=2.12
Requires-Dist: rich<15,>=14
Requires-Dist: typer<1,>=0.24
Provides-Extra: audit
Requires-Dist: pip-audit<3,>=2.9; extra == "audit"
Provides-Extra: dev
Requires-Dist: hypothesis>=6; extra == "dev"
Requires-Dist: pyright>=1.1; extra == "dev"
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: pytest-cov>=6; extra == "dev"
Requires-Dist: ruff>=0.8; extra == "dev"
Provides-Extra: release
Requires-Dist: build>=1; extra == "release"
Requires-Dist: pyinstaller>=6; extra == "release"
Requires-Dist: python-semantic-release<11,>=10; extra == "release"
Requires-Dist: twine>=5; extra == "release"
Dynamic: license-file

# Azurator

Azurator rotates shared-key credentials for Azure services and updates
supported places where they are stored.

> [!WARNING]
> Azurator is pre-alpha. Key rotation changes Azure and cannot be rolled back.
> Review the displayed changes before confirming them.

## Installation

Python installations require Python 3.10 or newer. The default login uses the
[Azure CLI](https://learn.microsoft.com/cli/azure/install-azure-cli).

```bash
pipx install azurator
```

Other install paths:

- `pip install azurator`
- prebuilt archives from the [latest release](https://github.com/janthmueller/azurator/releases/latest)
- `nix run github:janthmueller/azurator -- --help`

The optional SOPS workflow also requires SOPS 3.13.x. See the
[installation guide](https://janthmueller.github.io/azurator/getting-started/installation/)
for details.

## Quick Start

Rotate keys already stored in a dotenv file:

```bash
azurator login
azurator rotate --env-file .env
```

Azurator matches the file values to supported Azure keys, shows every planned
change, asks once for confirmation, rotates the keys, and updates the file and
supported Azure configuration that stores the same values.

Inspect or preview first when needed:

```bash
azurator match --env-file .env
azurator plan --env-file .env
```

## Other Workflows

- `azurator rotate` selects keys interactively.
- `azurator rotate --sops-file secrets.enc.env` updates a SOPS-encrypted dotenv file.
- `azurator export --sops-out azure-keys.enc.env` creates a new SOPS-encrypted dotenv file.
- `azurator export --out azure-keys.env` creates a new dotenv file from selected keys.
- `azurator discover` lists supported key resources without retrieving key values.

## Current Scope

Azurator rotates Storage Account keys and the `Key1` and `Key2` credentials
exposed by Azure AI, Cognitive Services, and Azure OpenAI. When the same key is
stored in a selected dotenv file, a supported Foundry project connection, or an
App Service application setting, Azurator can update that configuration during
the rotation.

Azurator checks only the documented configuration types. It does not discover
every Azure secret or prove that a running workload uses a key.

See [Supported Key Resources and Bindings](https://janthmueller.github.io/azurator/reference/supported-keys-and-bindings/)
for the exact current coverage.

## Shared Keys and Microsoft Entra ID

Shared keys are useful for prototypes and existing integrations, but they must
be stored, distributed, and rotated. Prefer Microsoft Entra ID when the service
and workload support it. Use Azurator when shared keys remain the practical
choice.

Read Microsoft's guidance for
[secretless authentication](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/secretless-authentication),
[Foundry authentication](https://learn.microsoft.com/en-us/azure/foundry/concepts/authentication-authorization-foundry),
and [Azure Storage Shared Key](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent).

## Documentation

See the [documentation](https://janthmueller.github.io/azurator/) for setup,
supported workflows, and recovery.

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md).

## License

[MIT](LICENSE)
