rules/findings/azure/keyvault/azure-keyvault-certificate-validity-period-not-compliant.json
|
{
"provider": "Azure", "serviceType": "Azure KeyVault", "serviceName": "Storage", "displayName": "Ensure certificate \u0027Validity Period (in months)\u0027 is less than or equal to \u0027_ARG_0_\u0027", "description": "Restrict the validity period of certificates stored in Azure Key Vault to _ARG_0_ months or less.", "rationale": "Limiting certificate validity reduces the risk of misuse if compromised and helps ensure timely renewal, improving security and reliability.", "impact": "Minor administrative effort required to ensure certificate renewal and lifecycle management.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Key vaults. 2. Click the name of a key vault. 3. Under Objects, click Certificates. 4. Click the name of a certificate. 5. Click Issuance Policy. 6. Set Validity Period (in months) to an integer between 1 and _ARG_0_, inclusive. 7. Click Save. 8. Repeat steps 1-7 for each key vault and certificate requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates", "https://learn.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest", "https://learn.microsoft.com/en-us/powershell/module/az.keyvault/?view=azps-15.4.0" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.3.11", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_keyvault", "subPath": null, "selectCondition": {}, "data": { "properties": { "objects.certificates.*": null, "id": "keyVaultId", "name": "name", "location": "location" }, "expandObject": "objects.certificates" }, "query": [ { "filter": [ { "conditions": [ [ "attributes.expireinMonths", "gt", "_ARG_0_" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "keyvaultId": "id", "name": "name", "location": "Location", "id": "KeyId", "attributes.expirationDate": "Expiration Date" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "keyvaultId": "id", "name": "name", "location": "Location", "id": "KeyId", "attributes.expirationDate": "Expiration Date" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure certificate \u0027Validity Period (in months)\u0027 is less than or equal to \u0027_ARG_0_\u0027 for {name}", "defaultMessage": "Ensure certificate \u0027Validity Period (in months)\u0027 is less than or equal to \u0027_ARG_0_\u0027" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "KeyVaultCertificate" }, "onlyStatus": false } }, "idSuffix": "azure_key_vault_certificate_validity_non_compliant", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "azure_keyvault_011" } |