Hi, I have a use case where I need to update a secret value every week. Each update creates a new version of the secret. Over a year, this results in approximately 52 versions. I want to restrict it so that only the last 7 versions are retained. Is it possible to achieve this? Additionally, what is the maximum limit for the number of secret versions in Azure Key Vault? Thank you!

Hi Subhash , Welcome to MS Q&A The maximum limit for the number of versions on a secret in Azure Key Vault is 500. However, it's important to note that storing a large number of versions (500+) can impact the performance of backup operations. As for your use case of retaining only the last 7 versions, Azure Key Vault does not automatically delete previous versions of a secret. To achieve this, you would need to implement a cleanup process that removes older versions of secrets. For more information, you can refer to the following Azure documentation and below Image Azure Key vault service limits Azure Key Vault Backup About Azure Key Vault secrets Please let me know if any questions Kindly accept answer if it helps Thanks Deepanshu

Can we control the version of an Azure key vault secret?

Accepted answer

Deepanshukatara-6769 7,830 Reputation points

2024-07-17T06:52:04.4+00:00
Hi Subhash , Welcome to MS Q&A

The maximum limit for the number of versions on a secret in Azure Key Vault is 500. However, it's important to note that storing a large number of versions (500+) can impact the performance of backup operations.

As for your use case of retaining only the last 7 versions, Azure Key Vault does not automatically delete previous versions of a secret. To achieve this, you would need to implement a cleanup process that removes older versions of secrets.

For more information, you can refer to the following Azure documentation and below Image

Azure Key vault service limits

Azure Key Vault Backup

About Azure Key Vault secrets

Please let me know if any questions

Kindly accept answer if it helps

Thanks

Deepanshu
Please sign in to rate this answer.
Subhash Kumar Mahato 120 Reputation points

2024-07-17T07:33:04.4466667+00:00

Thank you for your response. Additionally, can you please share some information how to clean up the older version of the secrets?

Deepanshukatara-6769 7,830 Reputation points

2024-07-17T08:38:31.07+00:00

Ok , To automate the deletion of all versions of secrets in Azure Key Vaults that are older than 7 days, you can use Azure Automation with a runbook. First, you need to create a PowerShell script that will delete the secrets. Then, you can create a runbook in Azure Automation that will execute the script on a schedule.

Here are the high-level steps to accomplish this:

Create a PowerShell script to delete the secrets. You can use the Get-AzKeyVaultSecret cmdlet to retrieve the secrets and their versions, and the Remove-AzKeyVaultSecret cmdlet to delete them. You can filter the secrets based on their creation date to only delete the ones that are older than 7 days.

Create an Azure Automation account and import the PowerShell script as a runbook.

Create a schedule for the runbook to execute on. You can configure the schedule to run every day or every week, depending on your needs.

Test the runbook to make sure it's working as expected. You can do this by manually starting the runbook and verifying that the old secrets are deleted.

Monitor the runbook to ensure that it's running successfully and that there are no errors.

For more detailed information on how to create a runbook in Azure Automation, see the following reference:

Encryption of secure assets in Azure Automation

References:

Encryption of secure assets in Azure Automation

Azure Key Vault secrets tutorial: Automate the rotation of a secret for resources that use one set of authentication credentials

please accept if it works and helpful

Thanks

Deepanshu

Subhash Kumar Mahato 120 Reputation points

2024-07-17T09:12:55.2966667+00:00

Hi Deepanshu,

I really appreciate your answer. Thank you for this detailed explanation.
Sign in to comment

Share via

Can we control the version of an Azure key vault secret?

0 additional answers