Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
keyvault_key_rotation_enabledProvider: Azure
Service:
keyvaultSeverity: HIGH
Categories:
encryptionResource type:
microsoft.keyvault/vaults/keysWhat this check verifies
Each Azure Key Vault key is assessed for a rotation policy that includes aRotate lifetime action scheduling automatic key version creation.
Risk
Without auto-rotation, keys may outlive policy, increasing exposure if material is leaked and weakening confidentiality. Expired keys without planned rollover can break decrypt/unwrap operations, impacting availability. Long-lived keys hinder incident response and enable prolonged misuse of stale versions.Recommendation
Define a per-key rotation policy to automaticallyRotate on a fixed cadence (e.g., P2Y) and set an expiry to enforce lifecycle.
Use versionless key URIs in dependent services, apply least privilege to rotation roles, enable near-expiry notifications, and monitor events for defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#update-the-key-version
- https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
- https://www.techtarget.com/searchcloudcomputing/tutorial/How-to-perform-and-automate-key-rotation-in-Azure-Key-Vault
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = keyvault_key_rotation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks