Key Vaults Secrets/Key Expiration

Question

Azure Key vault -key has two expiration dates configured at 2 places.

1. While creating the key you can setup an expiration date. Need to specify the date and time.
2. While configuring key rotation policy. Need to specify the expiry time.

So, have the following questions:

1. What is the use of having an expiry time at two places?
2. What is the difference between them?
3. If both are configured which one gets applied or supersedes?

Answer 1

Hi @VIVEK DWIVEDI ,

Thanks for reaching out and apologies for delay in response.

The expiration date and the expiry time in Azure Key Vault are two different concepts.

What is the use of having an expiry time at two places?

The expiration date is the date and time when the key will no longer be valid. This is set when you create the key.

The expiry time is the time interval after which the key will be rotated. This is set when you configure the key rotation policy.

What is the difference between them?

The key rotation policy is used to automatically rotate the key after a specified time interval. The key rotation policy is used to ensure that the key is rotated regularly, which helps to maintain the security of the key.

If both the expiration date and the expiry time are configured, the key will be rotated after the expiry time has elapsed. If the key is rotated, the new key will have the expiration date set when the key was created.

If both are configured which one gets applied or supersedes?

In summary, the expiration date is the date and time when the key will no longer be valid, and the expiry time is the time interval after which the key will be rotated. The key rotation policy supersedes the expiration date.

Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy

https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.