feat: explicit max ttl for secrets #199
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add `explicit_max_ttl` to Azure role attributes. If set, Application Secrets in Azure AD will be created with a maximum lifetime equal to `explicit_max_ttl` instead of the hard-coded 10-year default in effect until now. Fixes hashicorp#178 Fixes VAULT-12316
gsantos-hc
force-pushed
the
feat/explicit-max-ttl
branch
from
df91eef
to
0fb38e1
Compare
|
One thing missing from this is communicating to the client that the secret won't be renewed beyond its initial |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Add
explicit_max_ttlto Azure role attributes. When set, Application Secrets in Azure AD will be created with a maximum lifetime equal toexplicit_max_ttl, instead of the hard-coded 10-year default in effect until now.This enables organizations with compliance requirements to limit secret lifetimes to implement a hard ceiling on the secret's lifetime. This also serves as a backstop against the possibility of Vault failing to revoke the secret when the lease expires.
Design of Change
How was this change implemented?
Related Issues/Pull Requests
Contributor Checklist