1. Packages
  2. Azure Classic
  3. API Docs
  4. keyvault
  5. getKey

We recommend using Azure Native.

Viewing docs for Azure v6.34.0
published on Wednesday, Apr 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azure

azure.keyvault.getKey

azure logo

We recommend using Azure Native.

Viewing docs for Azure v6.34.0
published on Wednesday, Apr 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azure

    Use this data source to access information about an existing Key Vault Key.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const example = azure.keyvault.getKey({
    name: "secret-sauce",
    keyVaultId: existing.id,
});
export const keyType = example.then(example => example.keyType);

    import pulumi
import pulumi_azure as azure

example = azure.keyvault.get_key(name="secret-sauce",
    key_vault_id=existing["id"])
pulumi.export("keyType", example.key_type)

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := keyvault.LookupKey(ctx, &keyvault.LookupKeyArgs{
			Name:       "secret-sauce",
			KeyVaultId: existing.Id,
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("keyType", example.KeyType)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;

return await Deployment.RunAsync(() => 
{
    var example = Azure.KeyVault.GetKey.Invoke(new()
    {
        Name = "secret-sauce",
        KeyVaultId = existing.Id,
    });

    return new Dictionary<string, object?>
    {
        ["keyType"] = example.Apply(getKeyResult => getKeyResult.KeyType),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.keyvault.KeyvaultFunctions;
import com.pulumi.azure.keyvault.inputs.GetKeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = KeyvaultFunctions.getKey(GetKeyArgs.builder()
            .name("secret-sauce")
            .keyVaultId(existing.id())
            .build());

        ctx.export("keyType", example.keyType());
    }
}

    variables:
  example:
    fn::invoke:
      function: azure:keyvault:getKey
      arguments:
        name: secret-sauce
        keyVaultId: ${existing.id}
outputs:
  keyType: ${example.keyType}

    Using getKey

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getKey(args: GetKeyArgs, opts?: InvokeOptions): Promise<GetKeyResult>
function getKeyOutput(args: GetKeyOutputArgs, opts?: InvokeOptions): Output<GetKeyResult>
    def get_key(key_vault_id: Optional[str] = None,
            name: Optional[str] = None,
            opts: Optional[InvokeOptions] = None) -> GetKeyResult
def get_key_output(key_vault_id: Optional[pulumi.Input[str]] = None,
            name: Optional[pulumi.Input[str]] = None,
            opts: Optional[InvokeOptions] = None) -> Output[GetKeyResult]
    func LookupKey(ctx *Context, args *LookupKeyArgs, opts ...InvokeOption) (*LookupKeyResult, error)
func LookupKeyOutput(ctx *Context, args *LookupKeyOutputArgs, opts ...InvokeOption) LookupKeyResultOutput

    > Note: This function is named LookupKey in the Go SDK.

    public static class GetKey 
{
    public static Task<GetKeyResult> InvokeAsync(GetKeyArgs args, InvokeOptions? opts = null)
    public static Output<GetKeyResult> Invoke(GetKeyInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetKeyResult> getKey(GetKeyArgs args, InvokeOptions options)
public static Output<GetKeyResult> getKey(GetKeyArgs args, InvokeOptions options)

    fn::invoke:
  function: azure:keyvault/getKey:getKey
  arguments:
    # arguments dictionary

    The following arguments are supported:

    KeyVaultId string

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    Name string
    Specifies the name of the Key Vault Key.
    KeyVaultId string

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    Name string
    Specifies the name of the Key Vault Key.
    keyVaultId String

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    name String
    Specifies the name of the Key Vault Key.
    keyVaultId string

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    name string
    Specifies the name of the Key Vault Key.
    key_vault_id str

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    name str
    Specifies the name of the Key Vault Key.
    keyVaultId String

    Specifies the ID of the Key Vault instance where the Secret resides, available on the azure.keyvault.KeyVault Data Source / Resource.

    Note: The vault must be in the same subscription as the provider. If the vault is in another subscription, you must create an aliased provider for that subscription.

    name String
    Specifies the name of the Key Vault Key.

    getKey Result

    The following output properties are available:

    Curve string
    The EC Curve name of this Key Vault Key.
    E string
    The RSA public exponent of this Key Vault Key.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyOpts List<string>
    A list of JSON web key operations assigned to this Key Vault Key
    KeySize int
    Specifies the Size of this Key Vault Key.
    KeyType string
    Specifies the Key Type of this Key Vault Key
    KeyVaultId string
    N string
    The RSA modulus of this Key Vault Key.
    Name string
    PublicKeyOpenssh string
    The OpenSSH encoded public key of this Key Vault Key.
    PublicKeyPem string
    The PEM encoded public key of this Key Vault Key.
    ResourceId string
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    ResourceVersionlessId string
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    Tags Dictionary<string, string>
    A mapping of tags assigned to this Key Vault Key.
    Version string
    The current version of the Key Vault Key.
    VersionlessId string
    The Base ID of the Key Vault Key.
    X string
    The EC X component of this Key Vault Key.
    Y string
    The EC Y component of this Key Vault Key.
    Curve string
    The EC Curve name of this Key Vault Key.
    E string
    The RSA public exponent of this Key Vault Key.
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyOpts []string
    A list of JSON web key operations assigned to this Key Vault Key
    KeySize int
    Specifies the Size of this Key Vault Key.
    KeyType string
    Specifies the Key Type of this Key Vault Key
    KeyVaultId string
    N string
    The RSA modulus of this Key Vault Key.
    Name string
    PublicKeyOpenssh string
    The OpenSSH encoded public key of this Key Vault Key.
    PublicKeyPem string
    The PEM encoded public key of this Key Vault Key.
    ResourceId string
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    ResourceVersionlessId string
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    Tags map[string]string
    A mapping of tags assigned to this Key Vault Key.
    Version string
    The current version of the Key Vault Key.
    VersionlessId string
    The Base ID of the Key Vault Key.
    X string
    The EC X component of this Key Vault Key.
    Y string
    The EC Y component of this Key Vault Key.
    curve String
    The EC Curve name of this Key Vault Key.
    e String
    The RSA public exponent of this Key Vault Key.
    id String
    The provider-assigned unique ID for this managed resource.
    keyOpts List<String>
    A list of JSON web key operations assigned to this Key Vault Key
    keySize Integer
    Specifies the Size of this Key Vault Key.
    keyType String
    Specifies the Key Type of this Key Vault Key
    keyVaultId String
    n String
    The RSA modulus of this Key Vault Key.
    name String
    publicKeyOpenssh String
    The OpenSSH encoded public key of this Key Vault Key.
    publicKeyPem String
    The PEM encoded public key of this Key Vault Key.
    resourceId String
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    resourceVersionlessId String
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    tags Map<String,String>
    A mapping of tags assigned to this Key Vault Key.
    version String
    The current version of the Key Vault Key.
    versionlessId String
    The Base ID of the Key Vault Key.
    x String
    The EC X component of this Key Vault Key.
    y String
    The EC Y component of this Key Vault Key.
    curve string
    The EC Curve name of this Key Vault Key.
    e string
    The RSA public exponent of this Key Vault Key.
    id string
    The provider-assigned unique ID for this managed resource.
    keyOpts string[]
    A list of JSON web key operations assigned to this Key Vault Key
    keySize number
    Specifies the Size of this Key Vault Key.
    keyType string
    Specifies the Key Type of this Key Vault Key
    keyVaultId string
    n string
    The RSA modulus of this Key Vault Key.
    name string
    publicKeyOpenssh string
    The OpenSSH encoded public key of this Key Vault Key.
    publicKeyPem string
    The PEM encoded public key of this Key Vault Key.
    resourceId string
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    resourceVersionlessId string
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    tags {[key: string]: string}
    A mapping of tags assigned to this Key Vault Key.
    version string
    The current version of the Key Vault Key.
    versionlessId string
    The Base ID of the Key Vault Key.
    x string
    The EC X component of this Key Vault Key.
    y string
    The EC Y component of this Key Vault Key.
    curve str
    The EC Curve name of this Key Vault Key.
    e str
    The RSA public exponent of this Key Vault Key.
    id str
    The provider-assigned unique ID for this managed resource.
    key_opts Sequence[str]
    A list of JSON web key operations assigned to this Key Vault Key
    key_size int
    Specifies the Size of this Key Vault Key.
    key_type str
    Specifies the Key Type of this Key Vault Key
    key_vault_id str
    n str
    The RSA modulus of this Key Vault Key.
    name str
    public_key_openssh str
    The OpenSSH encoded public key of this Key Vault Key.
    public_key_pem str
    The PEM encoded public key of this Key Vault Key.
    resource_id str
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    resource_versionless_id str
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    tags Mapping[str, str]
    A mapping of tags assigned to this Key Vault Key.
    version str
    The current version of the Key Vault Key.
    versionless_id str
    The Base ID of the Key Vault Key.
    x str
    The EC X component of this Key Vault Key.
    y str
    The EC Y component of this Key Vault Key.
    curve String
    The EC Curve name of this Key Vault Key.
    e String
    The RSA public exponent of this Key Vault Key.
    id String
    The provider-assigned unique ID for this managed resource.
    keyOpts List<String>
    A list of JSON web key operations assigned to this Key Vault Key
    keySize Number
    Specifies the Size of this Key Vault Key.
    keyType String
    Specifies the Key Type of this Key Vault Key
    keyVaultId String
    n String
    The RSA modulus of this Key Vault Key.
    name String
    publicKeyOpenssh String
    The OpenSSH encoded public key of this Key Vault Key.
    publicKeyPem String
    The PEM encoded public key of this Key Vault Key.
    resourceId String
    The (Versioned) ID for this Key Vault Key. This property points to a specific version of a Key Vault Key, as such using this won't auto-rotate values if used in other Azure Services.
    resourceVersionlessId String
    The Versionless ID of the Key Vault Key. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Key is updated.
    tags Map<String>
    A mapping of tags assigned to this Key Vault Key.
    version String
    The current version of the Key Vault Key.
    versionlessId String
    The Base ID of the Key Vault Key.
    x String
    The EC X component of this Key Vault Key.
    y String
    The EC Y component of this Key Vault Key.

    Package Details

    Repository
    Azure Classic pulumi/pulumi-azure
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azurerm Terraform Provider.
    azure logo

    We recommend using Azure Native.

    Viewing docs for Azure v6.34.0
    published on Wednesday, Apr 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-azure
      Try Pulumi Cloud free. Your team will thank you.