steampipe plugin install azuresteampipe plugin install azure

azure_ad_group azure_ad_service_principal azure_ad_user azure_alert_management azure_api_management azure_app_configuration azure_app_service_environment azure_app_service_function_app azure_app_service_plan azure_app_service_web_app azure_app_service_web_app_slot azure_application_gateway azure_application_insight azure_application_security_group azure_automation_account azure_automation_variable azure_bastion_host azure_batch_account azure_cognitive_account azure_compute_availability_set azure_compute_disk azure_compute_disk_access azure_compute_disk_encryption_set azure_compute_disk_metric_read_ops azure_compute_disk_metric_read_ops_daily azure_compute_disk_metric_read_ops_hourly azure_compute_disk_metric_write_ops azure_compute_disk_metric_write_ops_daily azure_compute_disk_metric_write_ops_hourly azure_compute_image azure_compute_resource_sku azure_compute_snapshot azure_compute_ssh_key azure_compute_virtual_machine azure_compute_virtual_machine_metric_cpu_utilization azure_compute_virtual_machine_metric_cpu_utilization_daily azure_compute_virtual_machine_metric_cpu_utilization_hourly azure_compute_virtual_machine_scale_set azure_compute_virtual_machine_scale_set_network_interface azure_compute_virtual_machine_scale_set_vm azure_container_group azure_container_registry azure_cosmosdb_account azure_cosmosdb_mongo_collection azure_cosmosdb_mongo_database azure_cosmosdb_restorable_database_account azure_cosmosdb_sql_database azure_data_factory azure_data_factory_dataset azure_data_factory_pipeline azure_data_lake_analytics_account azure_data_lake_store azure_databox_edge_device azure_databricks_workspace azure_diagnostic_setting azure_dns_zone azure_eventgrid_domain azure_eventgrid_topic azure_eventhub_namespace azure_express_route_circuit azure_firewall azure_firewall_policy azure_frontdoor azure_hdinsight_cluster azure_healthcare_service azure_hpc_cache azure_hybrid_compute_machine azure_hybrid_kubernetes_connected_cluster azure_iothub azure_iothub_dps azure_key_vault azure_key_vault_deleted_vault azure_key_vault_key azure_key_vault_key_version azure_key_vault_managed_hardware_security_module azure_key_vault_secret azure_kubernetes_cluster azure_kubernetes_service_version azure_kusto_cluster azure_lb azure_lb_backend_address_pool azure_lb_nat_rule azure_lb_outbound_rule azure_lb_probe azure_lb_rule azure_location azure_log_alert azure_log_profile azure_logic_app_workflow azure_machine_learning_workspace azure_management_group azure_management_lock azure_mariadb_server azure_monitor_activity_log_event azure_mssql_elasticpool azure_mssql_managed_instance azure_mssql_virtual_machine azure_mysql_flexible_server azure_mysql_server azure_nat_gateway azure_network_interface azure_network_security_group azure_network_watcher azure_network_watcher_flow_log azure_policy_assignment azure_policy_definition azure_postgresql_flexible_server azure_postgresql_server azure_private_dns_zone azure_provider azure_public_ip azure_recovery_services_backup_job azure_recovery_services_vault azure_redis_cache azure_resource_group azure_resource_link azure_role_assignment azure_role_definition azure_route_table azure_search_service azure_security_center_auto_provisioning azure_security_center_automation azure_security_center_contact azure_security_center_jit_network_access_policy azure_security_center_setting azure_security_center_sub_assessment azure_security_center_subscription_pricing azure_service_fabric_cluster azure_servicebus_namespace azure_signalr_service azure_spring_cloud_service azure_sql_database azure_sql_server azure_storage_account azure_storage_blob azure_storage_blob_service azure_storage_container azure_storage_queue azure_storage_share_file azure_storage_sync azure_storage_table azure_storage_table_service azure_stream_analytics_job azure_subnet azure_subscription azure_synapse_workspace azure_tenant azure_virtual_network azure_virtual_network_gateway

Table: azure_key_vault_secret

Azure Key Vault is a cloud service for securely storing and accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys.

Examples

Basic info

select
  name,
  id,
  vault_name,
  enabled,
  created_at,
  updated_at,
  value
from
  azure_key_vault_secret;

List disabled secrets

select
  name,
  vault_name,
  enabled
from
  azure_key_vault_secret
where
  not enabled;

List secrets that do not expire

select
  name,
  enabled,
  expires_at
from
  azure_key_vault_secret
where
  expires_at is null;

List enabled secrets that have never been updated

select
  name,
  enabled,
  created_at,
  updated_at
from
  azure_key_vault_secret
where
  enabled
  and age(updated_at, created_at) = '00:00:00';

Count the number of secrets by vault

select
  vault_name,
  count(vault_name) as count
from
  azure_key_vault_secret
group by
  vault_name;

Control examples

.inspect azure_key_vault_secret

Azure Key Vault Secret

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
cloud_environment	text	The Azure Cloud Environment.
content_type	text	Specifies the type of the secret value such as a password.
created_at	timestamp with time zone	Specifies the time when the secret is created.
enabled	boolean	Indicates whether the secret is enabled, or not.
expires_at	timestamp with time zone	Specifies the time when the secret will expire.
id	text	Contains ID to identify a secret uniquely.
kid	text	If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.
managed	boolean	Indicates whether the secret's lifetime is managed by key vault, or not.
name	text	The friendly name that identifies the secret.
not_before	timestamp with time zone	Specifies the time before which the secret is not usable.
recoverable_days	bigint	Specifies the soft delete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
recovery_level	text	The deletion recovery level currently in effect for the object. If it contains 'Purgeable', then the object can be permanently deleted by a privileged user; otherwise, only the system can purge the object at the end of the retention interval.
region	text	The Azure region/location in which the resource is located.
resource_group	text	The resource group which holds this resource.
subscription_id	text	The Azure Subscription ID in which the resource is located.
tags	jsonb	A map of tags for the resource.
title	text	Title of the resource.
updated_at	timestamp with time zone	Specifies the time when the secret was last updated.
value	text	Specifies the secret value.
vault_name	text	The friendly name that identifies the vault.