Kubernetes clusters should have key vault secret rotation enabled
Checks that Azure Kubernetes clusters have key vault secret rotation enabled. Checkov CKV_AZURE_172 looks for autorotation of Secrets Store CSI Driver secrets for AKS clusters. The check applies to `azurerm_kubernetes_cluster`.
What this control checks
Kubernetes clusters must have key vault secret rotation enabled
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.kubernetes_cluster_key_vault_secret_rotation_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_172.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_key_vault_secret_rotation_enabled - Checkov Check:
CKV_AZURE_172 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_key_vault_secret_rotation_enabled
Last reviewed: 2026-10-13