2

I am trying to set up alerts for key vault certificate expiration. So I get an azure alert say when the cert is about to expire in X days.

Many thanks

Infra-builder-DOI
  • 21
  • 1
  • 2
  • Ok, so what is the issue? – Skin Apr 17 '22 at 11:09
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. – Community Apr 17 '22 at 11:17
  • Enable diagnostic settings on the Key Vault and save it to a log analytics workspace, then you can create a custom log alert rule, to trigger on the e.g. Microsoft.KeyVault.CertificateNearExpiry event. – burna Apr 17 '22 at 20:47

2 Answers2

1

To set up alerts for key vault certificate expiration, try below steps:

Azure Key vault provides mechanism to trigger events when the status of a secret stored in key vault has changed. Key Vault integration with Event Grid allows users to be notified when the status of secret stored in key vault has changed.

you can make use of Microsoft.KeyVault.CertificateNearExpiry Triggers when the currents version is about to expire (30 days) as mentioned in the expiry date of the Key vault record.

  • To create event grid subscription**, go to key vault -> Events -> get started -> logic apps**
  • To configure the Event Grid Trigger select your subscription , your Resource Type as Microsoft.KeyVault.vaults and select your key vault name -> click Save As
  • Along with logic apps Event Grid System Topic is created automatically in the logic app triggered select event type as Microsoft.KeyVault.CertificateNearExpiry

To more in detail please refer this link :

https://azureintegrations.com/2021/03/20/monitoring-and-alerting-for-azure-key-vault/

Imran
  • 3,875
  • 2
  • 3
  • 12
0

If you're fine with email alerting you can use Certificate Contacts, a functionality specific to Key Vault. First you need to provide the email addresses of notifications recipients here:

enter image description here

Notifications will be sent for each stored certificate that has its Issuance Policy lifecycle attributes set to Email all contacts (can be either the number of days to expiry or at percentage of a lifetime):

enter image description here

Note that it can be updated also for the existing certificates, despite the fact that the message at the top of this window says the opposite.

Setting this up will result in notifications being sent automatically:

enter image description here

Chanandler Bong
  • 403
  • 1
  • 11
  • 23