Azure KeyValut Secret Expired Event Not Getting Fired

Question

Azure KeyValut Secret Expired Event Not Getting Fired

Modou Diouf 0

Hi,

I have a secret stored in azure key vault with an expired date ,

I want to be notified when the secret near be expired (30 days after the expiration date).

To do that, i used

Azure Event Grid to listen the key vault secret event with Microsoft.KeyVault.SecretNearExpiry and Microsoft.KeyVault.SecretExpired,
Azure Key vault
Alert group (Azure Monitor) to send notification.

But i do not receive notification when the secret near be expired. And i hope the configuration is correct because when i add Microsoft.KeyVault.SecretNewVersionCreated in the Azure Event Grid config, i receive the notification for a new secret created in azure key vault.

I'm following these documentation
https://learn.microsoft.com/en-us/azure/event-grid/handle-key-vault-events-using-azure-monitor-alerts
https://dsfrederic1.medium.com/get-notified-when-azure-key-vault-secrets-expire-b0038bfb937f
https://medium.com/version-1/azure-key-vault-secret-expiry-notifications-using-azure-alerts-e6930d3f135d

Thanks

1 answer

Your answer

Answer 1

Marilee Turscak-MSFT 37,226 Microsoft Employee Moderator

Hi @Modou Diouf ,

If you are not receiving the alert, there are a few things I would check. First, go to the Key Vault and check the Events tab to confirm if the event itself fired.

User's image

Then, confirm that the logs themselves are enabled for the Key Vault. As long as logs are enabled, all of the events should be recorded:

KeyNearExpiryEventGridNotification
KeyExpiredEventGridNotification
SecretNearExpiryEventGridNotification
SecretExpiredEventGridNotification
SecretExpiredEventGridNotification
CertificateExpiredEventGridNotification

https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault#operation-names-table

You should also be able to see more details in the Webhook.

If everything seems to be set up correctly, I would recommend making a ticket with the Event Grid team.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions. Otherwise let me know if you have further questions.

Modou Diouf 0 Reputation points

2024-08-05T09:25:06.9033333+00:00
Hi Marilee Turscak-MSFT
I do the same configuration as below:

Create a key vault

Create azure logs analitics workspace

Enable diagnostic settings Key vault to send logs to logs analytics workspace

Create a topic system on azure event grid associat it with the key vault

Create an Event subscription on azure key vault Event

Configure Alert Monitor as endpoint Type to send alert on email

Select Secret Near Expire, Secret Expired, Secret New Version Created as Event Types

Create a secret in the key vault with a expire date

The alert received in email when created a new azure key vault secret:

In my email, i only receive the alert of Secret New Version Created Type event,
but when the secret is expired, i don’t receive alert.

I want to know why i don’t receive alerts when the secret is expired ?

Share via

Azure KeyValut Secret Expired Event Not Getting Fired

1 answer

Your answer