Expiry time of a key vs key rotation policy

Question

Hi all,
I have a question let say i have this kind of code

rsa_key = key_client.create_rsa_key(key_name, size=4096)     
actions = [
	KeyRotationLifetimeAction(             
		KeyRotationPolicyAction.rotate, 
		time_before_expiry="P30D"         
	)     
]      
key_rotation_policy = KeyRotationPolicy(lifetime_actions=actions, expires_in="P1Y")
key_client.update_key_rotation_policy(key_name, key_rotation_policy)

Will that key ever rotate without setting expire_on at key creation level?

Answer 1

Hi @Robos •
Thanks for posting your question in the Microsoft Q&A forum.
According to your query, the key rotation policy is defined with a lifetime, and the key should rotate within 30 days before expiration. However, if you don't set the key expiration (expire_on) when creating the key, it will not rotate automatically.
Key rotation policy settings:

• Expiry time: key expiration interval (minimum 28 days). It is used to set expiration date on a newly rotated key (e.g. after rotation, the new key is set to expire in 30 days).
• Rotation types:
  Automatically renew at a given time after creation
  Automatically renew at a given time before expiry. 'Expiration Date' must be set on the key for this event to fire.

For additional information refer this links: https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/key-rotation#key-rotation-policy
https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation#key-rotation-policy
Hope this helps. Do let us know if you any further queries.

Best Regards,
Harshitha Eligeti.