steampipe plugin install azure

Table: azure_key_vault_secret - Query Azure Key Vault Secrets using SQL

Azure Key Vault Secret is a resource within Microsoft Azure that allows you to securely store and tightly control access to tokens, passwords, certificates, API keys, and other secrets. It provides a centralized way to manage application secrets and control their distribution. Azure Key Vault Secret helps maintain application secrets with a high level of security.

Table Usage Guide

The azure_key_vault_secret table provides insights into the secrets stored in Azure Key Vaults. As a security engineer, explore secret-specific details through this table, including secret attributes, versions, and associated metadata. Utilize it to uncover information about secrets, such as their recovery level, enabled status, and expiration dates.

Examples

Basic info

Explore the status and details of your Azure Key Vault secrets. This query is useful to keep track of the secrets' status, enabling you to manage and monitor them effectively.

select
name,
id,
vault_name,
enabled,
created_at,
updated_at,
value
from
azure_key_vault_secret;
select
name,
id,
vault_name,
enabled,
created_at,
updated_at,
value
from
azure_key_vault_secret;

List disabled secrets

Explore which secrets within the Azure Key Vault are currently disabled. This can help in managing access and maintaining the security of your vault.

select
name,
vault_name,
enabled
from
azure_key_vault_secret
where
not enabled;
select
name,
vault_name,
enabled
from
azure_key_vault_secret
where
not enabled;

List secrets that do not expire

Discover the segments that consist of non-expiring secrets within Azure's key vault. This can be useful in managing and identifying potential security risks associated with indefinite secret keys.

select
name,
enabled,
expires_at
from
azure_key_vault_secret
where
expires_at is null;
select
name,
enabled,
expires_at
from
azure_key_vault_secret
where
expires_at is null;

List enabled secrets that have never been updated

Identify the enabled secrets within your Azure Key Vault that have remained unchanged since their creation. This is useful for security purposes and ensuring that secret keys are being regularly updated and managed properly.

select
name,
enabled,
created_at,
updated_at
from
azure_key_vault_secret
where
enabled
and age(updated_at, created_at) = '00:00:00';
select
name,
enabled,
created_at,
updated_at
from
azure_key_vault_secret
where
enabled
and (julianday(updated_at) - julianday(created_at)) * 24 * 60 * 60 = 0;

Count the number of secrets by vault

Assess the elements within your Azure Key Vault by counting the number of secrets each vault holds. This allows you to understand the distribution of secrets across your vaults, helping to manage and balance storage.

select
vault_name,
count(vault_name) as count
from
azure_key_vault_secret
group by
vault_name;
select
vault_name,
count(vault_name) as count
from
azure_key_vault_secret
group by
vault_name;

Schema for azure_key_vault_secret

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
akasjsonbArray of globally unique identifier strings (also known as) for the resource.
cloud_environmenttextThe Azure Cloud Environment.
content_typetextSpecifies the type of the secret value such as a password.
created_attimestamp with time zoneSpecifies the time when the secret is created.
enabledbooleanIndicates whether the secret is enabled, or not.
expires_attimestamp with time zoneSpecifies the time when the secret will expire.
idtextContains ID to identify a secret uniquely.
kidtextIf this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.
managedbooleanIndicates whether the secret's lifetime is managed by key vault, or not.
nametext=The friendly name that identifies the secret.
not_beforetimestamp with time zoneSpecifies the time before which the secret is not usable.
recoverable_daysbigintSpecifies the soft delete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
recovery_leveltextThe deletion recovery level currently in effect for the object. If it contains 'Purgeable', then the object can be permanently deleted by a privileged user; otherwise, only the system can purge the object at the end of the retention interval.
regiontextThe Azure region/location in which the resource is located.
resource_grouptextThe resource group which holds this resource.
sp_connection_nametext=, !=, ~~, ~~*, !~~, !~~*Steampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
subscription_idtext=, !=, ~~, ~~*, !~~, !~~*The Azure Subscription ID in which the resource is located.
tagsjsonbA map of tags for the resource.
titletextTitle of the resource.
updated_attimestamp with time zoneSpecifies the time when the secret was last updated.
valuetextSpecifies the secret value.
vault_nametext=The friendly name that identifies the vault.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- azure

You can pass the configuration to the command with the --config argument:

steampipe_export_azure --config '<your_config>' azure_key_vault_secret