Project: KICS (Provisioning / Security & Compliance)
File: cff9c3f7-e8f0-455f-9fb4-5f72326da96e.md

title: Secret Without Expiration Date hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cff9c3f7-e8f0-455f-9fb4-5f72326da96e Query name: Secret Without Expiration Date Platform: AzureResourceManager Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: All Secrets must have an expiration date defined<br> ```json title="Positive test num. 1 - json file" hl_lines="49" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } } }, { "name": "keyVault1/secretid1", "type": "Microsoft.KeyVault/vaults/secrets", "apiVersion": "2019-09-01", "tags": {}, "properties": { "value": "string", "contentType": "string" } } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="54" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } }, "resources": [ { "type": "secrets", "name": "keyVaultSecret1", "apiVersion": "2016-10-01", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', 'keyVault1')]" ], "properties": { "value": "string", "contentType": "string", "attributes": { "enabled": true, "nbf": 1585206000 } } } ] } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="51" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } } }, { "name": "keyVault1/secretid1", "type":

"apiVersion": "2019-09-01", "tags": {}, "properties": { "value": "string", "contentType": "string" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="56" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } }, "resources": [ { "type": "secrets", "name": "keyVaultSecret1", "apiVersion": "2016-10-01", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', 'keyVault1')]" ], "properties": { "value": "string", "contentType": "string", "attributes": { "enabled": true, "nbf": 1585206000 } } } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } }, "resources": [ { "type": "secrets", "name": "keyVaultSecret1", "apiVersion": "2016-10-01", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', 'keyVault1')]" ], "properties": { "value": "secretValue", "attributes": { "enabled": true, "nbf": 1585206000, "exp": 1679814000 } } } ] } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "keyVault1", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2016-10-01", "location": "[resourceGroup().location]", "tags": { "displayName": "keyVault1" }, "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForDiskEncryption": true, "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "accessPolicies": [ { "tenantId": "xx0xxx10-00x0-00x0-0x01-x0x0x01xx100", "objectId": "objectId", "permissions": { "keys": [ "Get" ], "secrets": [ "List", "Get", "Set" ] } } ], "sku": { "name": "standard", "family": "A" } }, "resources": [ { "type": "secrets", "name": "keyVaultSecret1", "apiVersion": "2016-10-01", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', 'keyVault1')]" ], "properties": { "value": "secretValue", "attributes": { "enabled": true, "nbf": 1585206000, "exp": 1679814000 } } } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ```