How to Mock Azure Key Vault Secret Get in Python
Mock an Azure Key Vault client's get_secret method with unittest.mock to test functions that retrieve secret values without hitting the real service.
Python code
37 linesimport unittest
from unittest.mock import MagicMock, patch
def get_secret(key_vault_client, secret_name):
"""Retrieve a secret value from an Azure Key Vault client."""
secret = key_vault_client.get_secret(secret_name)
return secret.value
class TestKeyVaultSecretGet(unittest.TestCase):
def test_get_mocked_secret(self):
# Create a real mock of the Azure Key Vault client
mock_client = MagicMock()
# Configure the mock to return a specific secret value
mock_secret = MagicMock()
mock_secret.value = "mock-secret-value-123"
mock_client.get_secret.return_value = mock_secret
# Call the function under test
result = get_secret(mock_client, "my-test-secret")
# Assert the result
self.assertEqual(result, "mock-secret-value-123")
mock_client.get_secret.assert_called_once_with("my-test-secret")
def test_get_secret_with_patch(self):
# Alternative: patch the client before calling
with patch("__main__.get_secret") as mock_get:
mock_get.return_value = "patched-secret"
result = get_secret(MagicMock(), "another-secret")
self.assertEqual(result, "patched-secret")
if __name__ == "__main__":
unittest.main()
Output
..
----------------------------------------------------------------------
Ran 2 tests in 0.001s
OK
How it works
The MagicMock class replaces the Azure Key Vault client so tests never make network calls. Configuring mock_client.get_secret.return_value makes the mock return a controlled secret object, and mock_secret.value supplies the actual string you want to verify. The function under test stays unchanged, proving it works against a mocked interface with the same API surface. The assert_called_once_with check verifies the exact argument passed to the mocked method. The patch variant demonstrates a higher-level mock that bypasses the function entirely, useful for isolating callers in larger test suites.
Common mistakes
- Forgetting to set `mock_secret.value` before assigning it as the return value
- Using `mock_client.get_secret.return_value = 'string'` instead of a MagicMock with a .value attribute
- Not asserting the mock was called with the expected secret name
- Testing against the real Key Vault endpoint and leaking credentials or secrets
Variations
- Use `patch('module.get_secret')` to mock at the module level and control return values directly
- Use a `MagicMock` spec of the actual Azure SDK client class to catch method-name typos
Real-world use cases
- Unit-testing a service that reads database credentials from Key Vault at startup without provisioning a vault.
- Verifying that environment-specific secret names are passed correctly before a cloud deployment.
- Testing error-handling paths when a secret is missing or expired, using mock side effects.
Sponsored
More from Cloud + Python
- Build a URL Shortener Client with Python medium
- Create a Cloud Storage Helper Class in Python easy
- Create a Data Helper Class for Beginners in Python easy
- Cross Account Role Chaining Mock Credentials in Python medium
- Exponential Backoff with Jitter for Cloud API Calls in Python medium
- Generate Mock CloudFormation Stack Events in Python easy
Keep learning
Related tutorials and quizzes for this topic.