Key Vault Secret should have an expiration date set

High Azure General secrets-key-vault-secret-expiration

Applies to

Microsoft.KeyVault/vaults/secrets

What CGPulse checks

A resource passes this rule when expires must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set an expiration date on secrets to enforce regular rotation and prevent stale credentials. In Azure Portal: Key Vault > Secrets > select secret > set Expiration date. See: https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets

CLI

az keyvault secret set-attributes --id "https://<vault-name>.vault.azure.net/secrets/<secret-name>" --expires "2025-12-31T00:00:00Z"

Bicep

resource secret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {{
  parent: keyVault
  name: '<secret-name>'
  properties: {{
    attributes: {{
      enabled: true
      exp: 1767225600  // Unix timestamp for expiration
    }}
  }}
}}

Terraform

resource "azurerm_key_vault_secret" "{name}" {
  name            = "<secret-name>"
  value           = "<secret-value>"
  key_vault_id    = azurerm_key_vault.{name}.id
  expiration_date = "2025-12-31T00:00:00Z"
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan