AzPolicyAdvertizer

last sync: 2021-Sep-22 19:36:51 UTC

Azure Policy definition

Secrets should not be active for longer than the specified number of days

Name Secrets should not be active for longer than the specified number of days
Azure Portal
Id e8d99835-8a06-45ae-a8e0-87a91941ccfe
Version 1.0.1
details on versioning
Category Key Vault
Microsoft docs
Description If your secrets were created with an activation date set in the future, you must ensure that your secrets have not been active for longer than the specified duration.
Mode Microsoft.KeyVault.Data
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: Audit
Allowed: (Audit, Deny, Disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-08-30 14:27:30 change Patch, old suffix: preview (1.0.0-preview > 1.0.1)
2020-10-16 12:27:50 add e8d99835-8a06-45ae-a8e0-87a91941ccfe
Used in Initiatives none
JSON Changes

JSON 
{
  "displayName": "Secrets should not be active for longer than the specified number of days",
  "policyType": "BuiltIn",
  "mode": "Microsoft.KeyVault.Data",
  "description": "If your secrets were created with an activation date set in the future, you must ensure that your secrets have not been active for longer than the specified duration.",
  "metadata": {
    "version": "1.0.1",
    "category": "Key Vault"
  },
  "parameters": {
    "maximumValidityInDays": {
      "type": "Integer",
      "metadata": {
        "displayName": "The maximum validity period in days",
        "description": "Specify the maximum number of days a secret can be valid for after activation."
      }
    },
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
      },
      "allowedValues": [
        "Audit",
        "Deny",
        "Disabled"
      ],
      "defaultValue": "Audit"
    }
  },
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.KeyVault.Data/vaults/secrets"
        },
        {
          "value": "[utcNow()]",
          "greater": "[addDays(if(empty(field('Microsoft.KeyVault.Data/vaults/secrets/attributes.notBefore')), field('Microsoft.KeyVault.Data/vaults/secrets/attributes.createdOn'), field('Microsoft.KeyVault.Data/vaults/secrets/attributes.notBefore')), parameters('maximumValidityInDays'))]"
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]"
    }
  }
}