Get notified of changes in Azure Key Vault by using Event Grid
Tags: azure, keyvault, security
Published: 2020-12-22 14:39:57

---
title: Get notified of changes in Azure Key Vault by using Event Grid
published: true
date: 2020-08-24 10:30:00 UTC
tags: Azure,KeyVault,security
canonical_url: https://zimmergren.net/get-notified-of-changes-in-azure-key-vault-using-event-grid/
---

 ![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-handlers-1.png)

There are numerous ways to secure and audit your Azure Key Vault setup and usage. In 2019, I wrote [Who accessed my Azure Key Vault?](https://zimmergren.net/azure-key-vault-diagnostics-who-accessing-your-vault/), which is still relevant.

In this article, I want to talk about how to set up automatic notifications when something change related to your secrets.

## Events in Key Vaults

Before we drill into the steps to get this done, I want to talk about events in general, and things we might want to think about before we dive in.

### What events can we subscribe to? 

The Azure Key Vault uses EventGrid for events. The currently supported events are listed on the Microsoft Docs website, listed under "[Event Grid event schema](https://docs.microsoft.com/en-us/azure/event-grid/event-schema-key-vault#event-grid-event-schema?WT.mc_id=AZ-MVP-4021705)" for the Key Vault docs.

Events can be subscribed to relating to three types of objects - Certificates, Keys, and Secrets. Here's what we can hook up:

**Certificates**

- New Certificate Version created
- Certificate expires within 30 days
- Certificate has expired

**Keys**

- New Key Version created
- Key expires within 30 days
- Key has expired

**Secrets**

- New Secret Version created
- Secret expires within 30 days
- Secret has expired

### Keep this in mind

When you design your systems to consume events, keep in mind a couple of important things.

- Always ensure your consumer validates where the event is coming from. A single EventGrid can handle events from multiple Key Vaults, across multiple subscriptions. 
- Build resilient applications, and ensure you can easily handle changes in the services. I've talked about that in my podcast ([Ctrl+Alt+Azure Episode 11 - Considerations and Good Practices for Azure Developers](https://ctrlaltazure.com/episodes/011-considerations-and-practices-for-azure-developers)). 

## How To: Monitor Key Vault with Event Grid

Let's get to the interesting stuff. If you read the previous sections, we have walked through a couple of use cases I find interesting, and some additional information that can be beneficial around the events we now want to consume.

It's time to build an integration.

For the sake of this demonstration, I am going to populate an Azure Storage queue with the events. As you can see from the picture below, there are quite some options readily available.

You can either go to your Key Vault and "Events", and pick one of these nice looking boxes:

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-handlers.png)<figcaption>Choose a subscription type for Azure Key Vault events.</figcaption>

Or, you can create a new "Event Subscription" like this, which I'm going for:

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-createsubscription.png)<figcaption>Create a new Azure Key Vault Event Subscription from the Azure Portal</figcaption>

We can now define the details about this subscription. Schema, topics, event types to subscribe to, and more.

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-creationdialog.png)<figcaption>Azure Portal allows us to create new Event Subscriptions in an Azure Key Vault. Here we are creating a new event for the Azure Storage Queue endpoint.</figcaption>

I selected all 10 available events from the dropdown, ensuring I get notifications about everything that I can:

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-eventtypes.png)<figcaption>I opted-in for all the event types, to really try and stay on top of things.</figcaption>

For the purpose of this article, I am leaving the remaining settings unchanged. However, below is a short walk-through of other interesting settings you can do during creation.

#### Dead-Lettering

As per the Microsoft Docs website about [Dead letter and retry policy](https://docs.microsoft.com/en-us/azure/event-grid/manage-event-delivery#set-dead-letter-location?WT.mc_id=AZ-MVP-4021705), you can configure this on your subscription to define what should happen if the events cannot be delivered to storage.

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-deadlettering.png)<figcaption>Dead-lettering configuration for events.</figcaption>

#### Retry policies

You can also configure retry policies at this stage. There are default configurations available, and as per Microsoft Docs about [set retry policy](https://docs.microsoft.com/en-us/azure/event-grid/manage-event-delivery#set-retry-policy?WT.mc_id=AZ-MVP-4021705), the system will automatically try 24 hours, or 30 times.

If you want to change this default behavior, you can do that during creation, too.

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-retrypolicies.png)<figcaption>Azure Key Vault subscriptions to Azure Event Hub with retry policies.</figcaption>

#### Event Subscription Expiration Time

You can define when the subscription is going to expire.

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-expiresub.png)<figcaption>Define an expiration time for the event subscription.</figcaption>

#### Filters

You can define filters for your events, to ensure only events matching your filters are delivered.

- Subject Filtering: Filter on the subject, for example that it begins with, or ends with a particular string.
- Advanced Filters: Filter based on attributes of the events. This is an `AND` filter, hence only events matching ALL filters are delivered. 

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-filters.png)<figcaption>Add optional filters for events, to only parse events matching the filters.</figcaption>

### Review the results

After creation, you should see the subscription under "Events" - "Subscriptions" in your Azure Key Vault, and any events associated with it.

Below, you can see that my new subscription has a few "Published Events" in the metrics, because I manually updated a few secrets for the sake of providing this beautiful line on the chart.

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-subscriptionexist-1.png)<figcaption>Azure Key Vault events displaying the execution of events on the Events dashboard.</figcaption>

In my configuration section, I chose to send my events as queue messages to an Azure Storage Queue, and I can see that it's received a few events already:

![Get notified of changes in Azure Key Vault by using Event Grid](https://zimmergren.net/content/images/2020/08/kveg-eventsinstoragequeue.png)<figcaption>Aazure Storage Queue showing the recently added events that were triggered.</figcaption>

Every event looks something like this, with the unique detail for that given event.

<!--kg-card-begin: markdown-->
```
{
    "id": "dc272235-15f4-4fee-b56d-d37bbb7eb01d",
    "topic": "/subscriptions/REDACTED/resourceGroups/demos/providers/Microsoft.KeyVault/vaults/acrencryptiondemo",
    "subject": "AnotherSecretName",
    "eventType": "Microsoft.KeyVault.SecretNewVersionCreated",
    "data": {
        "Id": "https://acrencryptiondemo.vault.azure.net/secrets/AnotherSecretName/195d1c3f247a43648b92e1f2efcaed40",
        "VaultName": "acrencryptiondemo",
        "ObjectType": "Secret",
        "ObjectName": "AnotherSecretName",
        "Version": "195d1c3f247a43648b92e1f2efcaed40",
        "NBF": null,
        "EXP": null
    },
    "dataVersion": "1",
    "metadataVersion": "1",
    "eventTime": "2020-08-14T18:51:10.8137761Z"
}

```
<!--kg-card-end: markdown-->

From here on, I can decide what actions I need to take.

## Summary and links

We've seen how easy it is to make use of Azure Event Grid and the event subscriptions.

The rest is up to you! Thank you for reading - please leave a comment with your thoughts.