Azure Compliance ControlsAzure Key Vault
Non-RBAC key vaults should have 'Expiration Date' configured for all secrets
Secrets should have a defined expiration date and not be permanent. Each enabled secret in an Azure Key Vault (non-RBAC) is assessed to confirm it has an explicit expiration date (`expires` attribute) defined.
What this control checks
Non-RBAC key vaults should have an Expiration Date set on every secret
Framework mappings
The clauses this control is mapped to in each framework.
- 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.3.5: Strong authentication for users and administrators is established and managed.
- 8.3.7: Strong authentication for users and administrators is established and managed.
- 8.3.9: Strong authentication for users and administrators is established and managed.
3 more clauses
- 8.3.10.1: Strong authentication for users and administrators is established and managed.
- 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 9.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- 8.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-14.01B The cloud service provider has documented and implemented procedures to deactivate cryptographic keys once they expire. These procedures ensure that: - Expired keys are no longer used for encryption purposes, but may still be used for decryption if necessary;- Expired keys are no...
- DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
1 more clause
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- 8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- 8.4 Ensure that the Expiration Date is set for all Secrets in Non- RBAC Key Vaults
- 8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- 3.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_with_non_rbac_secret_expiration_set - Checkov Check:
CKV_AZURE_41 - Powerpipe Controls:
azure_compliance.control.keyvault_secret_expiration_set,azure_compliance.control.keyvault_with_non_rbac_secret_expiration_set - Prowler Check:
keyvault_non_rbac_secret_expiration_set - Azure Policy Definition:
98728c90-32c7-4049-8429-847dc0f4fe37 - KICS Query:
dfa20ffa-f476-428f-a490-424b41e91c7f - Trivy Check:
AZU-0017
Last reviewed: 2026-10-13