How to Mock Azure Key Vault Secret Get in Python

Mock an Azure Key Vault client's get_secret method with unittest.mock to test functions that retrieve secret values without hitting the real service.

Medium Python 3.9+ Aug 9, 2026 Cloud + Python 13 views 0 copies

Python code

37 lines
Python 3.9+
import unittest
from unittest.mock import MagicMock, patch


def get_secret(key_vault_client, secret_name):
    """Retrieve a secret value from an Azure Key Vault client."""
    secret = key_vault_client.get_secret(secret_name)
    return secret.value


class TestKeyVaultSecretGet(unittest.TestCase):
    def test_get_mocked_secret(self):
        # Create a real mock of the Azure Key Vault client
        mock_client = MagicMock()

        # Configure the mock to return a specific secret value
        mock_secret = MagicMock()
        mock_secret.value = "mock-secret-value-123"
        mock_client.get_secret.return_value = mock_secret

        # Call the function under test
        result = get_secret(mock_client, "my-test-secret")

        # Assert the result
        self.assertEqual(result, "mock-secret-value-123")
        mock_client.get_secret.assert_called_once_with("my-test-secret")

    def test_get_secret_with_patch(self):
        # Alternative: patch the client before calling
        with patch("__main__.get_secret") as mock_get:
            mock_get.return_value = "patched-secret"
            result = get_secret(MagicMock(), "another-secret")
            self.assertEqual(result, "patched-secret")


if __name__ == "__main__":
    unittest.main()

Output

stdout
..
----------------------------------------------------------------------
Ran 2 tests in 0.001s

OK

How it works

The MagicMock class replaces the Azure Key Vault client so tests never make network calls. Configuring mock_client.get_secret.return_value makes the mock return a controlled secret object, and mock_secret.value supplies the actual string you want to verify. The function under test stays unchanged, proving it works against a mocked interface with the same API surface. The assert_called_once_with check verifies the exact argument passed to the mocked method. The patch variant demonstrates a higher-level mock that bypasses the function entirely, useful for isolating callers in larger test suites.

Common mistakes

  • Forgetting to set `mock_secret.value` before assigning it as the return value
  • Using `mock_client.get_secret.return_value = 'string'` instead of a MagicMock with a .value attribute
  • Not asserting the mock was called with the expected secret name
  • Testing against the real Key Vault endpoint and leaking credentials or secrets

Variations

  1. Use `patch('module.get_secret')` to mock at the module level and control return values directly
  2. Use a `MagicMock` spec of the actual Azure SDK client class to catch method-name typos

Real-world use cases

  • Unit-testing a service that reads database credentials from Key Vault at startup without provisioning a vault.
  • Verifying that environment-specific secret names are passed correctly before a cloud deployment.
  • Testing error-handling paths when a secret is missing or expired, using mock side effects.

Sponsored

Run this sample

Open the browser IDE to tweak the example and see results without installing anything.

Open editor

More from Cloud + Python

Related tutorials and quizzes for this topic.