Back to Checks
azure

Key in RBAC-enabled Key Vault has expiration date set

keyvault_rbac_key_expiration_set
Service: keyvaultSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.keyvault/vaults/keys

Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (exp) attribute defined.

Prowler logoProwlerprowler-provider-azure

Risk

Keys without expiration can remain active indefinitely. If exposed, attackers can decrypt data, forge signatures (code/tokens), and maintain persistence, undermining confidentiality and integrity. Absent end-of-life also weakens rotation discipline and crypto agility.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks keyvault_rbac_key_expiration_set

Recommendation

  • Set exp on all enabled keys and enforce a rotation policy with short lifetimes and automated renewal.
  • Use governance policies to require expiration and alert before expiry.
  • Apply least privilege and separation of duties for key admins vs consumers.

Remediation

CLI

az keyvault key set-attributes --vault-name <vaultName> --name <keyName> --expires <YYYY-MM-DDThh:mm:ssZ>

Terraform

# Set an expiration date on a Key Vault key
resource "azurerm_key_vault_key" "<example_resource_name>" {
  name         = "<example_resource_name>"
  key_vault_id = "<example_resource_id>"
  key_type     = "RSA"

  expiration_date = "2025-12-31T23:59:59Z" # Critical: ensures the key has an expiration date to pass the check
}

NativeIaC

// Set an expiration date on a Key Vault key
resource key 'Microsoft.KeyVault/vaults/keys@2023-07-01' = {
  name: '<example_resource_name>/<example_resource_name>'
  properties: {
    kty: 'RSA'
    attributes: {
      exp: 1767225599 // Critical: expiration timestamp (UTC epoch seconds). Ensures the key has an expiration date to pass the check.
    }
  }
}

Other

1In Azure Portal, go to Key vaults and open <vaultName>
2Select Keys and choose the key missing an expiration
3Open the current version and click Update/Edit
4Set Expiration date (UTC) and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.keyvault.keyvault_client import keyvault_client


class keyvault_rbac_key_expiration_set(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, key_vaults in keyvault_client.key_vaults.items():
            subscription_name = keyvault_client.subscriptions.get(
                subscription, subscription
            )
            for keyvault in key_vaults:
                if keyvault.properties.enable_rbac_authorization:
                    for key in keyvault.keys or []:
                        if not key.enabled:
                            continue
                        report = Check_Report_Azure(
                            metadata=self.metadata(), resource=key
                        )
                        report.subscription = subscription
                        if not key.attributes.expires:
                            report.status = "FAIL"
                            report.status_extended = f"Key {key.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) does not have an expiration date set."
                        else:
                            report.status = "PASS"
                            report.status_extended = f"Key {key.name} in Key Vault {keyvault.name} from subscription {subscription_name} ({subscription}) has an expiration date set."
                        findings.append(report)
        return findings

References