Azure Compliance ControlsAzure Key Vault
RBAC key vaults should have 'Expiration Date' configured for all keys
Cryptographic keys should have a defined expiration date and not be permanent. Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (`exp`) attribute defined.
What this control checks
Keys in RBAC-enabled key vaults must have an expiration date set
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 9 Cryptography
- 12 Asset management
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- 9.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- 8.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
- 8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- 8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- 8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- 8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- 3.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_with_rbac_key_expiration_set - Checkov Check:
CKV_AZURE_40 - Powerpipe Controls:
azure_compliance.control.keyvault_key_expiration_set,azure_compliance.control.keyvault_with_rbac_key_expiration_set - Prowler Check:
keyvault_rbac_key_expiration_set - Azure Policy Definition:
152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 - Trivy Check:
AZU-0014
Last reviewed: 2026-10-13