skills.rest
Nethereum
NethereumOFFICIAL
Explore all skills by this author →
WebsiteGitHub

cloud-kms

Signs Ethereum transactions with AWS KMS or Azure Key Vault HSM keys in .NET.

2.3k|744|Updated Nov 23, 2015
Search Tags:#Ethereum#Azure Key Vault#transaction signing#nethereum#HSM#DotNet#aws kms
One-click install
npx skills add https://github.com/Nethereum/Nethereum --skill cloud-kms
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloud-kms
Source: https://github.com/Nethereum/Nethereum/tree/main/plugins/nethereum-skills/skills/cloud-kms
Command: npx skills add https://github.com/Nethereum/Nethereum --skill cloud-kms

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Nethereum.Signer.AWSKeyManagement, Nethereum.Signer.AzureKeyVault.

What problem does it solve?

Managing raw private keys in application code is a security risk. This Skill shows how to sign Ethereum transactions using keys generated and stored inside cloud HSMs (AWS KMS or Azure Key Vault), so private keys are never exported or exposed in your .NET application.

Core Features & Use Cases

  • AWS KMS Signing: Create secp256k1 keys in AWS KMS and sign Ethereum transactions via Nethereum.Signer.AWSKeyManagement with default, explicit, or region-specific credentials.
  • Azure Key Vault Signing: Create SECP256K1 keys in Azure Key Vault and sign via Nethereum.Signer.AzureKeyVault using DefaultAzureCredential, managed identity, or service principal authentication.
  • Full Transaction Support: Both signers support Legacy, EIP-1559, EIP-2930, and EIP-7702 transaction types through Nethereum's ExternalAccount.
  • Use Case: A serverless backend (AWS Lambda or Azure Function) needs to send ETH or interact with smart contracts without storing a private key file. Use this Skill to wire a cloud HSM key into a Nethereum Web3 instance and broadcast signed transactions.

Quick Start

Show me how to sign and send an Ethereum transaction in C# using an AWS KMS key with Nethereum.

Frequently Asked Questions about cloud-kms

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sign Ethereum transactions with AWS KMS in C#?▼

Install the Nethereum.Signer.AWSKeyManagement NuGet package, create an ECC_SECG_P256K1 key in AWS KMS, then wrap an AWSKeyManagementExternalSigner in an ExternalAccount. Pass that account to a Web3 instance to sign and send transactions.

How to use Azure Key Vault for Ethereum transaction signing?▼

Create an EC key with the SECP256K1 curve in Azure Key Vault, install Nethereum.Signer.AzureKeyVault, and construct an AzureKeyVaultExternalSigner with your key identifier. Use it with ExternalAccount and Web3 to send signed transactions.

Does AWS KMS signing support EIP-1559 transactions?▼

Yes. Both the AWS KMS and Azure Key Vault signers in Nethereum support Legacy, EIP-1559, EIP-2930, and EIP-7702 transaction types, since signing happens through the standard ExternalAccount abstraction.

Can I use managed identity with Azure Key Vault signing?▼

Yes. Pass a ManagedIdentityCredential to the AzureKeyVaultExternalSigner constructor. DefaultAzureCredential also works for auto-detected environments, and ClientSecretCredential supports service principal authentication.

Is the private key ever exposed when using cloud KMS signing?▼

No. The private key is generated inside the HSM and never exported. Nethereum sends the transaction hash to AWS KMS or Azure Key Vault, which returns only the signature.

Related Skills

Explore More Software Engineering Skills→
cockroachdbcockroachdb
3

enabling-cmek-encryption

Enable CMEK encryption on CockroachDB Cloud clusters with AWS KMS, GCP Cloud KMS, or Azure Key Vault.

Official
Advanced
robomotioniorobomotionio
2

ethereum

Automate Ethereum blockchain operations via CLI for balances, contracts, and events.

Official
Advanced
NethereumNethereum
2.3k

fee-estimation

Estimate EIP-1559 gas fees for Ethereum transactions using Nethereum.

Official
Intermediate
cyoteecyotee

voltaire-effect-signer

Sign Ethereum transactions and messages using private keys or mnemonic accounts.

Community
Advanced