Control: Key Vault keys should have an expiration date
Description
Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. It is a recommended security practice to set expiration dates on cryptographic keys.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.keyvault_key_expiration_setSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.keyvault_key_expiration_set --shareSQL
This control uses a named query:
select kvk.id as resource, case when enabled and expires_at is null then 'alarm' else 'ok' end as status, vault_name || ' key ' || name || case when enabled and expires_at is null then ' expiration date not set.' when not enabled then ' disabled.' else ' expiration date set to ' || to_char(expires_at, 'DD-Mon-YYYY') || '.' end as reason , kvk.resource_group as resource_group , sub.display_name as subscriptionfrom azure_key_vault_key kvk, azure_subscription subwhere sub.subscription_id = kvk.subscription_id;