Secret in RBAC-enabled Key Vault has expiration date set

Check ID: keyvault_rbac_secret_expiration_set
Provider: Azure
Service: keyvault
Severity: MEDIUM
Categories: secrets
Resource type: microsoft.keyvault/vaults/secrets

What this check verifies

Each enabled secret in an Azure Key Vault (RBAC) is assessed to confirm it has an exp (expiration) date configured.

Risk

Without an expiration, secrets become perpetual credentials. Leaked or abandoned values can grant persistent access, undermining confidentiality and integrity. Attackers can reuse old secrets to maintain footholds, perform unauthorized API calls, and exfiltrate data.

Recommendation

Set an expiration on all enabled secrets and enforce a regular rotation policy. Prefer short-lived, identity-based access to reduce secret usage. Apply least privilege for secret access, alert on upcoming expirations, and automate rotation and version cleanup to minimize exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az keyvault secret set-attributes —vault-name <vaultName> —name <secretName> —expires <YYYY-MM-DDTHH:MM:SSZ>

resource "azurerm_key_vault_secret" "<example_resource_name>" {
  name         = "<example_resource_name>"
  value        = "<secret_value>"
  key_vault_id = "<example_resource_id>"

  # CRITICAL: sets the secret expiration timestamp
  expiration_date = "2025-01-01T00:00:00Z"
}

// Set expiration on a Key Vault secret
resource secret 'Microsoft.KeyVault/vaults/secrets@2019-09-01' = {
  name: '<example_resource_name>/<example_resource_name>'
  properties: {
    // CRITICAL: sets the secret expiration timestamp (Unix epoch seconds)
    attributes: {
      exp: 1735689600 // 2025-01-01T00:00:00Z
    }
    value: '<secret_value>'
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_rbac_secret_expiration_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Key in RBAC-enabled Key Vault has expiration date set Key Vault has soft delete and purge protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires