turbot/steampipe-mod-azure-compliance

Control: Key Vault secrets should have an expiration date

Description

Secrets should have a defined expiration date and not be permanent. Secrets that are valid forever provide a potential attacker with more time to compromise them. It is a recommended security practice to set expiration dates on secrets.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.keyvault_secret_expiration_set

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.keyvault_secret_expiration_set --share

SQL

This control uses a named query:

select
kvs.id as resource,
case
when enabled and expires_at is null then 'alarm'
else 'ok'
end as status,
vault_name || ' secret ' || name ||
case
when enabled and expires_at is null then ' expiration date not set.'
when not enabled then ' disabled.'
else ' expiration date set to ' || to_char(expires_at, 'DD-Mon-YYYY') || '.'
end as reason
, kvs.resource_group as resource_group
, sub.display_name as subscription
from
azure_key_vault_secret as kvs,
azure_subscription as sub
where
sub.subscription_id = kvs.subscription_id;

Tags