Control: Key Vault secrets should have an expiration date
Description
Secrets should have a defined expiration date and not be permanent. Secrets that are valid forever provide a potential attacker with more time to compromise them. It is a recommended security practice to set expiration dates on secrets.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.keyvault_secret_expiration_setSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.keyvault_secret_expiration_set --shareSQL
This control uses a named query:
select kvs.id as resource, case when enabled and expires_at is null then 'alarm' else 'ok' end as status, vault_name || ' secret ' || name || case when enabled and expires_at is null then ' expiration date not set.' when not enabled then ' disabled.' else ' expiration date set to ' || to_char(expires_at, 'DD-Mon-YYYY') || '.' end as reason , kvs.resource_group as resource_group , sub.display_name as subscriptionfrom azure_key_vault_secret as kvs left join azure_subscription as sub on sub.subscription_id = kvs.subscription_id;