Azure / Azure/Azure-Landing-Zones

Question about secret lifetime in "Enforce recommended guardrails for Azure Key Vault" initiative

Open
#217 1 comment 0 reactions 0 assignees View on GitHub
Transfer From: Enterprise-Scale :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

**Describe the bug**

I've a question about the secret validty handling in the "Enforce recommended guardrails for Azure Key Vault" policy initiative
As far as I can see and understand the following parameters are both set to the value "90"

- secretsActiveInDays: 90 days
This parameter denies the creation of a secret with a lifetime greater than 90 days ( (PolicyDefinitionRefrence Id: Deny-KV-Secret-ActiveDays )

- minimumSecretsLifeDaysBeforeExpiry: 90 days (PolicyDefinitionRefrence Id: KvSecretsLifetime)
This parameter audits the lifetime of a secret which lifetime is shorter than 90 days (PolicyDefinitionRefrence Id: KvSecretsLifetime)
BTW: The parameter description doesn´t fit, seems to me copy from another parameter ?

So if I deploy this policy initiative I will never be able to create a compliant secret ?

**Screenshots**

Contributor guide

Open the contributing guide

Research direction

Review the "Enforce recommended guardrails for Azure Key Vault" initiative, focusing on the secretsActiveInDays and minimumSecretsLifeDaysBeforeExpiry parameters and the Deny-KV-Secret-ActiveDays and KvSecretsLifetime policy references. Confirm whether the two 90-day settings conflict, verify the minimumSecretsLifeDaysBeforeExpiry description, and document or correct the behavior so a compliant secret can be created.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.