Azure / Azure/Azure-Landing-Zones
Question about secret lifetime in "Enforce recommended guardrails for Azure Key Vault" initiative
- Dominant language
- PowerShell
- Stars
- 96
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
**Describe the bug**
I've a question about the secret validty handling in the "Enforce recommended guardrails for Azure Key Vault" policy initiative
As far as I can see and understand the following parameters are both set to the value "90"
- secretsActiveInDays: 90 days
This parameter denies the creation of a secret with a lifetime greater than 90 days ( (PolicyDefinitionRefrence Id: Deny-KV-Secret-ActiveDays )
- minimumSecretsLifeDaysBeforeExpiry: 90 days (PolicyDefinitionRefrence Id: KvSecretsLifetime)
This parameter audits the lifetime of a secret which lifetime is shorter than 90 days (PolicyDefinitionRefrence Id: KvSecretsLifetime)
BTW: The parameter description doesn´t fit, seems to me copy from another parameter ?
So if I deploy this policy initiative I will never be able to create a compliant secret ?
**Screenshots**
Contributor guide
Research direction
Review the "Enforce recommended guardrails for Azure Key Vault" initiative, focusing on the secretsActiveInDays and minimumSecretsLifeDaysBeforeExpiry parameters and the Deny-KV-Secret-ActiveDays and KvSecretsLifetime policy references. Confirm whether the two 90-day settings conflict, verify the minimumSecretsLifeDaysBeforeExpiry description, and document or correct the behavior so a compliant secret can be created.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100