azure_keyvault_managed_hsm_security_domain_download_backup.py

1import json
2from azure.identity import DefaultAzureCredential
3from azure.keyvault.securitydomain import KeyVaultSecurityDomainClient
4
5# Replace with your Managed HSM URL (e.g., "https://<your-hsm-name>.managedhsm.azure.net/")
6vault_url = "https://<your-hsm-name>.managedhsm.azure.net/"
7
8# The Security Domain requires a set of certificates to encrypt the shared secrets.
9# For this example, we assume you have a list of public certificates in PEM format.
10with open("certificate1.pem", "rb") as f:
11    cert1 = f.read()
12with open("certificate2.pem", "rb") as f:
13    cert2 = f.read()
14with open("certificate3.pem", "rb") as f:
15    cert3 = f.read()
16
17certificates = [cert1, cert2, cert3]
18
19# Create the client
20credential = DefaultAzureCredential()
21client = KeyVaultSecurityDomainClient(vault_url, credential)
22
23# Start the download process
24# 'required_signatures' is the number of shares needed to restore the Security Domain
25poller = client.begin_download(
26    certificates=certificates,
27    required_signatures=2
28)
29
30# Wait for the operation to complete and get the security domain
31security_domain = poller.result()
32
33# The security domain contains sensitive information and should be stored securely
34with open("security_domain.json", "w") as f:
35    json.dump(security_domain, f)
36
37print("Security Domain downloaded successfully.")