Service Principal Secret Expiration - Automation

Question

This is a design question

Right now when service principal credentials are expired, we have to (1) Regenerate (2) Update the same in keyvault (3) Update the same in wherever the SPN is used. Right now i am doing this manually for each SPN. Is there anyway we can automate this activity? What is the best approach to handle this situation. I have unfortunately 50+ SPN.

Answer 1

Hello @Rajesh Ambakkat

Here is an approach of how to automate the rotation of a secret:

• Thirty days before the expiration date of a secret, Key Vault publishes the near expiry event to Event Grid.
• Event Grid checks the event subscriptions and uses HTTP POST to call the function app endpoint that's subscribed to the event.
• An Azure Function is used with managed identity to rotate service principal keys.
• An Azure Function adds the new regenerated key to Azure Key Vault as the new version of the secret.

https://abschmidt.medium.com/rotating-service-principal-secrets-automatically-in-azure-key-vault-c4f04a84c9af

https://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation-dual?tabs=azure-cli

If you think your question has been answered, click "Mark as Answer" if just helped click "Vote as helpful". This can be beneficial to other community members reading this forum thread.

Answer 2

You don't say where you use the key vault. But have you considered devoid release management to handle the updating.

Answer 3

Wherever you possibly can, switch to using managed identities (system or user) instead of SPNs. They have no expiry and are automatically internally rotated and kept up to date for you. I use SPNs as a last resort, only for services that can't do managed identities.