Check ID: keyvault_rbac_key_expiration_set
Provider: Azure
Service: keyvault
Severity: MEDIUM
Categories: encryption
Resource type: microsoft.keyvault/vaults/keys

What this check verifies

Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (exp) attribute defined.

Risk

Keys without expiration can remain active indefinitely. If exposed, attackers can decrypt data, forge signatures (code/tokens), and maintain persistence, undermining confidentiality and integrity. Absent end-of-life also weakens rotation discipline and crypto agility.

Recommendation

  • Set exp on all enabled keys and enforce a rotation policy with short lifetimes and automated renewal.
  • Use governance policies to require expiration and alert before expiry.
  • Apply least privilege and separation of duties for key admins vs consumers.

Remediation

az keyvault key set-attributes —vault-name <vaultName> —name <keyName> —expires <YYYY-MM-DDThh:mm:ssZ>

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_rbac_key_expiration_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks