Back to Checks
azure

Key Vault key has automatic rotation enabled

keyvault_key_rotation_enabled
Service: keyvaultSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.keyvault/vaults/keys

Each Azure Key Vault key is assessed for a rotation policy that includes a Rotate lifetime action scheduling automatic key version creation.

Prowler logoProwlerprowler-provider-azure

Risk

Without auto-rotation, keys may outlive policy, increasing exposure if material is leaked and weakening confidentiality.

Expired keys without planned rollover can break decrypt/unwrap operations, impacting availability. Long-lived keys hinder incident response and enable prolonged misuse of stale versions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks keyvault_key_rotation_enabled

Recommendation

Define a per-key rotation policy to automatically Rotate on a fixed cadence (e.g., P2Y) and set an expiry to enforce lifecycle.

Use versionless key URIs in dependent services, apply least privilege to rotation roles, enable near-expiry notifications, and monitor events for defense in depth.

Remediation

CLI

az keyvault key rotation-policy update --vault-name <VAULT_NAME> --name <KEY_NAME> --value '{"lifetimeActions":[{"trigger":{"timeAfterCreate":"P18M"},"action":{"type":"Rotate"}}]}'

Terraform

resource "azurerm_key_vault_key" "key" {
  name         = "<example_resource_name>"
  key_vault_id = "<example_resource_id>"
  key_type     = "RSA"

  rotation_policy {
    automatic {
      time_after_creation = "P18M" # Critical: creates a Rotate lifetime action to enable auto-rotation
    }
  }
}

NativeIaC

resource key 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
  name: '<example_resource_name>/<example_resource_name>'
  location: resourceGroup().location
  properties: {
    kty: 'RSA'
    rotationPolicy: {
      lifetimeActions: [
        {
          trigger: { timeAfterCreate: 'P18M' }
          action: { type: 'Rotate' } // Critical: enables automatic rotation, satisfying the check
        }
      ]
    }
  }
}

Other

1In Azure Portal, go to Key Vaults > <your key vault> > Keys
2Select the key <KEY_NAME>
3Click Rotation policy
4Enable auto-rotation and set a rotation interval (e.g., After creation: P18M)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.keyvault.keyvault_client import keyvault_client


class keyvault_key_rotation_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, key_vaults in keyvault_client.key_vaults.items():
            subscription_name = keyvault_client.subscriptions.get(
                subscription, subscription
            )
            for keyvault in key_vaults:
                for key in keyvault.keys or []:
                    report = Check_Report_Azure(metadata=self.metadata(), resource=key)
                    report.subscription = subscription
                    if (
                        key.rotation_policy
                        and key.rotation_policy.lifetime_actions
                        and any(
                            action.action == "Rotate"
                            for action in key.rotation_policy.lifetime_actions
                        )
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Key {key.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) has a rotation policy set."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Key {key.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) does not have a rotation policy set."
                    findings.append(report)
        return findings

References