Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
keyvault_rbac_key_expiration_setProvider: Azure
Service:
keyvaultSeverity: MEDIUM
Categories:
encryptionResource type:
microsoft.keyvault/vaults/keysWhat this check verifies
Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (exp) attribute defined.
Risk
Keys without expiration can remain active indefinitely. If exposed, attackers can decrypt data, forge signatures (code/tokens), and maintain persistence, undermining confidentiality and integrity. Absent end-of-life also weakens rotation discipline and crypto agility.Recommendation
- Set
expon all enabled keys and enforce a rotation policy with short lifetimes and automated renewal. - Use governance policies to require expiration and alert before expiry.
- Apply least privilege and separation of duties for key admins vs consumers.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az keyvault key set-attributes —vault-name <vaultName> —name <keyName> —expires <YYYY-MM-DDThh:mm:ssZ>
References
- https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts
- https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#key-vault-keys
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/azure/KeyVault/key-expiration-check.html#
- https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-keyvault
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = keyvault_rbac_key_expiration_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks