Non-RBAC key vaults should have 'Expiration Date' configured for all keys
Cryptographic keys should have a defined expiration date and not be permanent. Keys that are valid forever provide a potential attacker with more time to compromise the key. Each enabled key in a vault using access policies (non-RBAC) is assessed.
Keys that are valid forever provide a potential attacker with more time to compromise the key. Non-expiring keys enable indefinite use, degrading confidentiality and integrity.
What this control checks
Keys in non-RBAC key vaults must have an expiration (exp) attribute defined.
Common pitfalls
Expiration date is not set by default
Expiration Date is an optional Key Vault Key behavior and is not set by default.
Checkov accepts any expiration_date value
Checkov CKV_AZURE_40 inspects expiration_date on azurerm_key_vault_key and accepts any value.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Key Vault keys should have an expiration date" (152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0); Prowler check keyvault_key_expiration_set_in_non_rbac (prowler azure --checks keyvault_key_expiration_set_in_non_rbac); PowerPipe controls azure_compliance.control.keyvault_key_expiration_set and azure_compliance.control.keyvault_with_non_rbac_key_expiration_set.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_40; KICS query "Key Expiration Not Set" (4d080822-5ee2-49a4-8984-68f3d4c890fc); Trivy check AZU-0014.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 3.5.1.1 (Primary account number (PAN) is secured wherever it is stored.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.), 3.6.1 (Cryptographic keys used to protect stored account data are secured.) and 9 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 2.1.2.f (evaluate the identified risks based on the risk criteria;), 6.1.2.b (requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or...) and 6 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5 (Authenticator Management).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 3.6.1: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
7 more clauses
- 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 9.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults.
- 8.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-14.01B The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no...
- DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
1 more clause
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- 8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- 8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- 8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- 3.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_with_non_rbac_key_expiration_set - Checkov Check:
CKV_AZURE_40 - Powerpipe Controls:
azure_compliance.control.keyvault_key_expiration_set,azure_compliance.control.keyvault_with_non_rbac_key_expiration_set - Prowler Check:
keyvault_key_expiration_set_in_non_rbac - Azure Policy Definition:
152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 - KICS Query:
4d080822-5ee2-49a4-8984-68f3d4c890fc - Trivy Check:
AZU-0014
Last reviewed: 2026-10-13