Back to Checks
azure

Secret in non-RBAC Key Vault has expiration date set

keyvault_non_rbac_secret_expiration_set
Service: keyvaultSeverity: medium
OfficialBuilt-inVerified
Categories:secrets
Resource Type:microsoft.keyvault/vaults/secrets

Each enabled secret in an Azure Key Vault (non-RBAC) is assessed to confirm it has an explicit expiration date (expires attribute) defined.

Prowler logoProwlerprowler-provider-azure

Risk

Secrets without expiration persist indefinitely, widening the window for misuse.

If leaked or forgotten, they allow long-term, covert access to services and data, undermining confidentiality and integrity, and complicating incident response and revocation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks keyvault_non_rbac_secret_expiration_set

Recommendation

Set an expiration on every secret and enforce a rotation policy aligned with risk and compliance.

Automate rotation and alerts, disable or purge stale versions, and apply least privilege. Where possible, use managed identities to reduce secret sprawl.

Remediation

CLI

az keyvault secret set-attributes --vault-name <vaultName> --name <secretName> --expires <YYYY-MM-DDTHH:MM:SSZ>

Terraform

resource "azurerm_key_vault_secret" "<example_resource_name>" {
  name         = "<example_resource_name>"
  value        = "<example_value>"
  key_vault_id = "<example_resource_id>"

  expiration_date = "2025-12-31T23:59:59Z" # CRITICAL: sets the secret expiration so the check passes
}

NativeIaC

// Set an expiration date on a Key Vault secret
resource secret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
  name: '<example_vault_name>/<example_resource_name>'
  properties: {
    value: '<example_value>'
    attributes: {
      exp: 1767225599 // CRITICAL: sets the secret expiration (Unix time in seconds) so the check passes
    }
  }
}

Other

1In the Azure portal, go to Key vaults and open your vault
2Select Secrets, then click the secret that failed
3Click + New version
4Set Expiration date and click Create
5Repeat for any other secret without an expiration

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.keyvault.keyvault_client import keyvault_client


class keyvault_non_rbac_secret_expiration_set(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, key_vaults in keyvault_client.key_vaults.items():
            subscription_name = keyvault_client.subscriptions.get(
                subscription, subscription
            )
            for keyvault in key_vaults:
                if not keyvault.properties.enable_rbac_authorization:
                    for secret in keyvault.secrets or []:
                        if not secret.enabled:
                            continue
                        report = Check_Report_Azure(
                            metadata=self.metadata(), resource=secret
                        )
                        report.subscription = subscription
                        if not secret.attributes.expires:
                            report.status = "FAIL"
                            report.status_extended = f"Secret {secret.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) does not have an expiration date set."
                        else:
                            report.status = "PASS"
                            report.status_extended = f"Secret {secret.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) has an expiration date set."
                        findings.append(report)
        return findings

References