How to fix "Secrets should have the specified maximum validity period"

Question

How to fix "Secrets should have the specified maximum validity period"

Lanh Khưu 46

what value of maximumValidityInDays ? How much?

VIVEK DWIVEDI 185 Reputation points Microsoft Employee

2023-02-22T07:53:38.4133333+00:00

When I pass the key expiration date in UTC format, it doesn't work. still getting an error t "denied by policy".
I don't think there is way to pass it in integer format (number of days.) The ARM portal and terraform only accept in date format.
How can I solve it ?

Accepted answer

0 additional answers

Your answer

VIVEK DWIVEDI 185 Reputation points Microsoft Employee

2023-02-22T07:53:38.4133333+00:00

When I pass the key expiration date in UTC format, it doesn't work. still getting an error t "denied by policy".
I don't think there is way to pass it in integer format (number of days.) The ARM portal and terraform only accept in date format.
How can I solve it ?

Answer 1

rafalzak 3,251

Hi @ LanhKhu-3439,

It depends on your company policy.
Using a secret with a long validity period is not recommended.
You can put there for example: 7 - for seven days, 31 for month,180 - for 6 months, 365 - for one year or more based on your requirements.

Please upvote or accept as answer if it helped.

Lanh Khưu 46 Reputation points

2022-11-03T10:27:07.913+00:00

Thanks, @rafalzak , How to get maximumvadityIndayws value?
rafalzak 3,251 Reputation points

2022-11-03T10:41:39.897+00:00

It's Integer so max value should be 2147483647
Lanh Khưu 46 Reputation points

2022-11-03T10:54:13.877+00:00

Sorry @rafalzak , I need to do what to fix this security.
rafalzak 3,251 Reputation points

2022-11-03T11:14:30.49+00:00

This policy checks by default (audit) if your secrets on Azure key vaults are compliant with requirements - in this case validity period.
If you define this policy with 365 days, it will check if your secrets and show you which are complaint. You can also set expiration date on each secret:
https://learn.microsoft.com/en-us/azure-stack/user/azure-stack-key-vault-manage-portal?view=azs-2206
In short this policy help you audit and set expiration time for secrets in your org as it's one of the best practice. You shouldn't use secrets without expiration date.
Lanh Khưu 46 Reputation points

2022-11-07T04:29:05.533+00:00

@rafalzak what mean of defaultvalue: "audit" , how many this value ?
rafalzak 3,251 Reputation points

2022-11-07T09:46:57.9+00:00

Default:
Audit

Allowed:
Audit, Deny, Disabled
Lanh Khưu 46 Reputation points

2022-11-07T11:00:55.127+00:00

Thanks, @rafalzak

Share via

How to fix "Secrets should have the specified maximum validity period"

0 additional answers

Your answer