azure key vault secret expiry notification

Question

azure key vault secret expiry notification

pattifree 46

I created a logic that will trigger when a keyvault.SecretNearExpiry. works fine. I want to get an email everyday intil the secret is updated in the key vault. This is where I am getting stuck the logic app stays at running. Does anyone know, if it's possible to get an email once a day intil the secret is updated?

Thanks in Advance,

Patti

shiva patpi 13,366 Reputation points Microsoft Employee Moderator

2023-06-27T23:44:09.1566667+00:00

@pattifree

After your trigger of SecretNearExpiry , Can you add a delay action for 24 hrs. followed by email ?

Do you also want to get the email , even after the secret got expired and till the secret gets updated with the new expiration ?
pattifree 46 Reputation points

2023-06-28T12:19:08.0033333+00:00

Yes. I need our teams to reminded Everday to update the secret. if they no longer need the secret they can manually remove them from the key vault.

1 answer

Your answer

shiva patpi 13,366 Reputation points Microsoft Employee Moderator

2023-06-27T23:44:09.1566667+00:00

@pattifree

After your trigger of SecretNearExpiry , Can you add a delay action for 24 hrs. followed by email ?

Do you also want to get the email , even after the secret got expired and till the secret gets updated with the new expiration ?
pattifree 46 Reputation points

2023-06-28T12:19:08.0033333+00:00

Yes. I need our teams to reminded Everday to update the secret. if they no longer need the secret they can manually remove them from the key vault.

Answer 1

MayankBargali-MSFT 70,941 Moderator

@pattifree Thanks for reaching out.

I believe you are using the Event Grid Trigger in your logic app workflow and subscribed to Microsoft.KeyVault.SecretNearExpiry event that triggers your workflow when the current version of a secret is about to expire. (The event is triggered 30 days before the expiration date.) and you want to send them email everyday till they have renewed the secret or deleted it.

Unfortunately, there is no out of box feature as the logic app will only trigger once so you need to have your own solution for your requirement.

One possible solution would be once your logic app is triggered30 days before the expiration date then in your workflow use storage table, SQL or per your need store that data received from your event grid.

Now you will have another workflow i.e. timer trigger that will trigger every day and get your stored data and validate whether the secret is deleted/renewed. You can use the Azure Resource Manager connector or the Azure REST API to make the call to get the secret and exp attribute to know the expiration date. Based on the expiration date you can take a call to either send the email. In case if it is deleted you may get 404 error, so you need to handle it in your workflow. Once the action has been taken based on the expiry date changed or 404 error now you can delete that entry from your storage table or any other data source that you are using for storing the details.

Similary there are many other ways to handle this in your workflow.

Feel free to get back to me if you have any queries or concerns.

pattifree 46 Reputation points

2023-06-29T13:23:20.4933333+00:00

@MayankBargali-MSFT I thought if I had recurrence(trigger) -> when resource event occurs(action) -> send email(action).

I would get an email once day or maybe once a week depending how the recurrence is set. Just to understand why that doesn't work.
MayankBargali-MSFT 70,941 Reputation points Moderator

2023-06-30T05:29:58.17+00:00

@pattifree Can you please confirm what connector action you are referring to as when resource event occurs?

I believe you are talking about When a resource event occurs event grid trigger (not action). If you have recurrence(trigger) so based on the internal and frequency that you have specified your logic app will gets triggered. Are you using multiple trigger on your workflow?
pattifree 46 Reputation points

2023-06-30T12:39:28.18+00:00

@MayankBargali-MSFT Yes. I am using when resource event occurs. I tried adding recurrence has a trigger, but it did allow me to add two triggers just one. when I added when resource event occurs became an action. In the logic app the trigger is running I do get an email Only once. I added a delay after the resource event occurs and another send email and that worked. It two repetitive in the code. I was hoping it would be simpler way of doing this. I am also using code (bicep).
MayankBargali-MSFT 70,941 Reputation points Moderator

2023-07-05T09:31:19.6466667+00:00

@pattifree Mutiple trigger are only supported in the code view and not the designer view. Your observation is correct, and my initial answer covered the solution for your problem to create a separate logic app. If you are using the timer trigger and then add when resource event occurs, then your workflow will further execute once when the secret is near expiry. There is no out of box feature to handle it and you need to make your own custom solution that I cover in my initial answer. Else you need have delay in your same workflow continuously and verify if the secret is deleted/renewed.

Share via

azure key vault secret expiry notification

1 answer

Your answer