On Azure KeyVault Key, Auto-rotate policy not detected #6687
Replies: 2 comments 5 replies
-
|
@nikpivkin can you take a look? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Joerg-L ! According to the logs, the |
Beta Was this translation helpful? Give feedback.
-
|
Hi @nikpivkin |
Beta Was this translation helpful? Give feedback.
-
|
The local path to the module must begin with |
Beta Was this translation helpful? Give feedback.
-
|
Hi @nikpivkin As you see, the issue still persists |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @Joerg-L . Why do you think the |
Beta Was this translation helpful? Give feedback.
-
|
While I'm not the OP on this, my 2 cents on this is that the expiration field on the key is an informational only field and doesn't prevent use of a key or secret after its expiration date, and is used to inform vault administrators that a specific secret or key needs to be rotated, or inform an application reading the metadata that it needs to check for a newer version of a secret if it's referencing a specific version of a key vault key, rather than the latest. With the auto-rotation policy, the key is automatically rotated based on the configured parameters which should satisfy most secret rotation policies for organizations, and my perspective on the check is that it's trying to identify managed secrets that are at risk of not being rotated on a regular basis. I've seen configs where someone plugs an expiration date decades into the future for a specific key or secret to silence the check. I personally just add a |
Beta Was this translation helpful? Give feedback.
-
IDs
AVD-AZU-0014
Description
We are createing an Azure KeyVault Key with following terraform code
Trivy
trivy config .prints outReproduction Steps
Target
Filesystem
Scanner
Misconfiguration
Target OS
No response
Debug Output
Version
Checklist
-f jsonthat shows data sources and confirmed that the security advisory in data sources was correctBeta Was this translation helpful? Give feedback.
All reactions