Description:

 Setting an Expiration Date for keys in Azure Key Vault (RBAC-enabled) ensures that keys are not used beyond their intended lifespan. Once the expiration date is reached, the key becomes inactive and cannot be used for cryptographic operations, enforcing a key management lifecycle. Enabling automatic expiration dates for keys in RBAC-enabled Key Vaults ensures compliance with security best practices, such as key rotation and periodic expiration, which are crucial for protecting sensitive data.

Rationale: 

Automating the expiration of keys is essential for reducing the risk of key misuse or compromise. Expiring keys automatically ensures that they are rotated periodically, minimizing the chances of using outdated or insecure keys. This practice helps meet regulatory requirements and security standards like SOC 2, HIPAA, GDPR, and NIST, which often mandate the management of cryptographic keys.

Impact: 

Enabling key expiration for RBAC-enabled Key Vaults ensures better security by enforcing automatic key lifecycle management. However, this requires ensuring that all applications using those keys are prepared for key expiration and can automatically use updated keys. Proper monitoring and automation should be set up to ensure smooth transitions when keys expire.

Default Value:

 By default, keys in Azure Key Vault (RBAC-enabled or not) do not have an expiration date unless explicitly configured. Expiration dates must be set either manually or through automated policies.

Pre-requisites:

  • Azure Key Vault (RBAC-enabled): Ensure the Key Vault is using Role-Based Access Control (RBAC) and contains keys that need expiration dates.

  • Permissions: You need Owner or Contributor role to configure keys and their expiration dates in RBAC-enabled Key Vaults.

  • Expiration Date Policy: Ensure that there is a mechanism in place to periodically set or update expiration dates for keys.

Remediation:

Audit:

To check if Expiration Dates are set for all keys in an RBAC-enabled Key Vault:

  1. Sign in to the Azure portal using an account with appropriate permissions.

  2. Navigate to the Azure Key Vault:

    • In the Azure portal, go to Key Vaults and select the relevant Key Vault.

  3. Check Keys:

    • In the Key Vault dashboard, click on Keys under Settings.

    • Verify if each key has an Expiration Date set. If expiration dates are missing, the keys should be updated to include them.

Automated Implementation:

To ensure that Expiration Dates are set for all keys in RBAC-enabled Key Vaults, you can automate this process using Azure Automation, Azure Logic Apps, or Azure CLI scripts.

  1. Automate Expiration Date Assignment using Azure Automation or Azure Logic Apps:

    • Create an Azure Automation runbook or Logic App that periodically checks the keys in Key Vault and sets or updates their expiration dates.

    • Example of an Azure Logic App flow:

      1. Get keys from Key Vault.

      2. For each key, set expiration date (e.g., 90 days from creation or last update).

      3. Update the key metadata in Azure Key Vault.

2.  Set Expiration Date via Azure CLI: Use Azure CLI to set expiration dates for keys in your RBAC-enabled Key Vault:

az keyvault key set --vault-name <YourKeyVaultName> --name <KeyName> --expires <ExpirationDate>

 Example:

az keyvault key set --vault-name "MyKeyVault" --name "MyKey" --expires "2023-12-31T00:00:00Z"

  1. Create an Azure Automation Runbook:

    • Use Azure Automation to create a runbook that periodically sets expiration dates for all keys within RBAC-enabled Key Vaults.

    • The script can be written in PowerShell or Python and scheduled to run periodically.

Example PowerShell Script for key expiration:

 $keyVaultName = "MyKeyVault"
$keys = Get-AzKeyVaultKey -VaultName $keyVaultName
foreach ($key in $keys) {
    $expirationDate = (Get-Date).AddDays(90)  # Set expiration date to 90 days from today
    Set-AzKeyVaultKey -VaultName $keyVaultName -Name $key.Name -Expires $expirationDate
}

Backout Plan:

To disable expiration dates for keys (not recommended from a security perspective):

  1. Sign in to the Azure portal with appropriate permissions.

  2. Navigate to the Azure Key Vault:

    • Go to Key Vaults in the Azure portal and select the relevant Key Vault.

  3. Go to Keys:

    • In the Settings section, click on Keys.

  4. Update Key:

    • For each key, remove the expiration date or set it to a longer duration if needed.

If automation was applied through Azure Logic Apps or Azure Automation, you can disable the runbook or Logic App.

References: