Key in non-RBAC Key Vault has expiration date set

Check ID: keyvault_key_expiration_set_in_non_rbac
Provider: Azure
Service: keyvault
Severity: HIGH
Categories: encryption
Resource type: microsoft.keyvault/vaults/keys

What this check verifies

Each enabled key in an Azure Key Vault using access policies (non-RBAC) is assessed to confirm it has an expiration (exp) attribute defined.

Risk

Non-expiring keys enable indefinite use, degrading confidentiality and integrity. Stale or compromised keys can decrypt data, forge signatures, and maintain persistence. Absent lifetimes weaken rotation discipline and impede timely revocation, increasing exposure to cryptographic and operational drift.

Recommendation

Set an expiration on all keys and enforce automated rotation with advance alerts. Retire or disable old versions promptly and rotate after any suspected exposure. Apply least privilege and separation of duties for key administration. Prefer standardized lifecycle policies (e.g., RBAC-based governance) to enforce consistent control.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az keyvault key set-attributes —vault-name <example_resource_name> —name <example_resource_name> —expires 2030-01-01T00:00:00Z

resource "azurerm_key_vault_key" "<example_resource_name>" {
  name         = "<example_resource_name>"
  key_vault_id = "<example_resource_id>"
  key_type     = "RSA"

  expires_on = "2030-01-01T00:00:00Z" # CRITICAL: sets key expiration to pass the check
}

// Set expiration on a Key Vault key
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
  name: '<example_resource_name>'
}

resource key 'Microsoft.KeyVault/vaults/keys@2023-07-01' = {
  name: '<example_resource_name>'
  parent: kv
  properties: {
    kty: 'RSA'
    attributes: {
      exp: 1893456000 // CRITICAL: sets the key expiration (Unix epoch seconds) to pass the check
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_key_expiration_set_in_non_rbac. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Key Vault with private endpoints blocks public access Key Vault key has automatic rotation enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires