feat: explicit max ttl for secrets #199
Conversation
gsantos-hc
force-pushed
the
feat/explicit-max-ttl
branch
from
df91eef
to
0fb38e1
Compare
|
One thing missing from this is communicating to the client that the secret won't be renewed beyond its initial |
|
Thank you for working on this! 👏 Everything looks good to me. I am currently testing it locally, not running into any issues so far. As for the secret renewal, I think that it makes sense for it not to be renewed if < role's ttl, we just need to make sure we document it as well. |
gsantos-hc
force-pushed
the
feat/explicit-max-ttl
branch
from
812483b
to
f6c66d5
Compare
|
Force-pushed to rebase from |
|
Can we please add changelog entry? We can update CHANGELOG.md file, we can add an entry here, something like After the PR is merged, I will open a PR on Vault side to update the documentation. |
|
Thanks for reviewing and testing, @Zlaticanin. I've updated the changelog. |
Add `explicit_max_ttl` to Azure role attributes. If set, Application Secrets in Azure AD will be created with a maximum lifetime equal to `explicit_max_ttl` instead of the hard-coded 10-year default in effect until now. Leases are renewable unless or until the remaining Azure-side lifetime is shorter than the role's configured TTL. Marking a lease as non-renewable signals to clients that they must obtain a new lease/secret when the existing one is approaching the limit that was originally set through `explicit_max_ttl`. Fixes hashicorp#178 Fixes VAULT-12316
gsantos-hc
force-pushed
the
feat/explicit-max-ttl
branch
from
a8ccc57
to
2f79d8d
Compare
|
Force-pushed to rebase from the latest |
Overview
Add
explicit_max_ttlto Azure role attributes. When set, Application Secrets in Azure AD will be created with a maximum lifetime equal toexplicit_max_ttl, instead of the hard-coded 10-year default in effect until now.This enables organizations with compliance requirements to limit secret lifetimes to implement a hard ceiling on the secret's lifetime. This also serves as a backstop against the possibility of Vault failing to revoke the secret when the lease expires.
Design of Change
How was this change implemented?
Related Issues/Pull Requests
Contributor Checklist