Secret in non-RBAC Key Vault has expiration date set

Check ID: keyvault_non_rbac_secret_expiration_set
Provider: Azure
Service: keyvault
Severity: MEDIUM
Categories: secrets
Resource type: microsoft.keyvault/vaults/secrets

What this check verifies

Each enabled secret in an Azure Key Vault (non-RBAC) is assessed to confirm it has an explicit expiration date (expires attribute) defined.

Risk

Secrets without expiration persist indefinitely, widening the window for misuse. If leaked or forgotten, they allow long-term, covert access to services and data, undermining confidentiality and integrity, and complicating incident response and revocation.

Recommendation

Set an expiration on every secret and enforce a rotation policy aligned with risk and compliance. Automate rotation and alerts, disable or purge stale versions, and apply least privilege. Where possible, use managed identities to reduce secret sprawl.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az keyvault secret set-attributes —vault-name <vaultName> —name <secretName> —expires <YYYY-MM-DDTHH:MM:SSZ>

resource "azurerm_key_vault_secret" "<example_resource_name>" {
  name         = "<example_resource_name>"
  value        = "<example_value>"
  key_vault_id = "<example_resource_id>"

  expiration_date = "2025-12-31T23:59:59Z" # CRITICAL: sets the secret expiration so the check passes
}

// Set an expiration date on a Key Vault secret
resource secret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
  name: '<example_vault_name>/<example_resource_name>'
  properties: {
    value: '<example_value>'
    attributes: {
      exp: 1767225599 // CRITICAL: sets the secret expiration (Unix time in seconds) so the check passes
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_non_rbac_secret_expiration_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Key Vault has a diagnostic setting with audit logging Key Vault uses private endpoints

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires