Key Vault keys should have an expiration date
Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. Setting expiration dates on cryptographic keys is a recommended security practice.
Keys that are valid forever provide a potential attacker with more time to compromise the key.
What this control checks
Checks Azure Key Vault keys for an expiration date setting
Common pitfalls
Expiration date is optional and not set by default
Expiration Date is an optional Key Vault Key behavior and is not set by default.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Key Vault keys should have an expiration date" (152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0); PowerPipe control azure_compliance.control.keyvault_key_expiration_set.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_40; Trivy check AZU-0014.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5 (Authenticator Management).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5: Authenticator Management
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 8.1 Ensure that the expiration date is set on all keys
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA-5 Authenticator Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_key_expiration_set - Checkov Check:
CKV_AZURE_40 - Powerpipe Control:
azure_compliance.control.keyvault_key_expiration_set - Azure Policy Definition:
152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 - Trivy Check:
AZU-0014
Last reviewed: 2026-10-13