Bird
Raised Fist0
Azurecloud~5 mins

Key rotation concepts in Azure - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Introduction
Key rotation means changing the secret keys used to protect your data regularly. This helps keep your information safe by limiting how long a key can be used if it gets lost or stolen.
When you want to improve security by updating keys before they expire or get compromised
When compliance rules require you to change keys every few months
When you suspect a key might have been exposed accidentally
When you want to automate key updates to avoid manual errors
When you use Azure Key Vault to store and manage your keys securely
Config File - keyrotation-policy.json
keyrotation-policy.json
{
  "attributes": {
    "enabled": true
  },
  "lifetimeActions": [
    {
      "trigger": {
        "timeBeforeExpiry": "P30D"
      },
      "action": {
        "type": "Rotate"
      }
    }
  ],
  "contentType": "application/json"
}

This JSON file defines a key rotation policy for Azure Key Vault.

attributes.enabled: Turns the policy on.

lifetimeActions: Specifies actions to take before the key expires.

trigger.timeBeforeExpiry: Sets the time before expiry to start rotation (30 days here).

action.type: Defines the action as rotation.

Commands
This command applies the key rotation policy to the key named 'my-key' in the 'my-keyvault' Azure Key Vault. It tells Azure to rotate the key 30 days before it expires.
Terminal
az keyvault key rotation-policy set --vault-name my-keyvault --name my-key --policy @keyrotation-policy.json
Expected OutputExpected
{ "attributes": { "enabled": true }, "id": "https://my-keyvault.vault.azure.net/keys/my-key/rotationpolicy", "lifetimeActions": [ { "action": { "type": "Rotate" }, "trigger": { "timeBeforeExpiry": "P30D" } } ], "contentType": "application/json" }
→
--vault-name - Specifies the name of the Azure Key Vault
→
--name - Specifies the name of the key to apply the policy
→
--policy - Points to the JSON file with the rotation policy
This command shows the current key rotation policy for the key 'my-key' in 'my-keyvault' to verify it was set correctly.
Terminal
az keyvault key rotation-policy show --vault-name my-keyvault --name my-key
Expected OutputExpected
{ "attributes": { "enabled": true }, "id": "https://my-keyvault.vault.azure.net/keys/my-key/rotationpolicy", "lifetimeActions": [ { "action": { "type": "Rotate" }, "trigger": { "timeBeforeExpiry": "P30D" } } ], "contentType": "application/json" }
→
--vault-name - Specifies the Azure Key Vault name
→
--name - Specifies the key name to check
This command manually triggers the rotation of the key 'my-key' in 'my-keyvault' immediately, useful for urgent key changes.
Terminal
az keyvault key rotate --vault-name my-keyvault --name my-key
Expected OutputExpected
{ "kid": "https://my-keyvault.vault.azure.net/keys/my-key/1234567890abcdef", "key": { "kid": "https://my-keyvault.vault.azure.net/keys/my-key/1234567890abcdef" } }
→
--vault-name - Specifies the Azure Key Vault name
→
--name - Specifies the key to rotate
Key Concept

If you remember nothing else from this pattern, remember: regularly changing your keys limits the risk if a key is lost or stolen.

Common Mistakes
Not enabling the rotation policy after creating it
The keys will not rotate automatically if the policy is not enabled, leaving keys unchanged and vulnerable.
Always set the 'enabled' attribute to true in the rotation policy JSON before applying it.
Using incorrect vault or key names in commands
Commands will fail or apply changes to the wrong resources, causing confusion or errors.
Double-check the vault and key names before running commands to ensure they match your Azure resources.
Forgetting to verify the rotation policy after setting it
You might think the policy is applied when it is not, leading to no key rotation happening.
Always run 'az keyvault key rotation-policy show' to confirm the policy is active and correct.
Summary
Create a key rotation policy JSON file that defines when and how keys rotate.
Use Azure CLI to apply the rotation policy to your keys in Azure Key Vault.
Verify the policy is set correctly and manually rotate keys if needed.

Practice

(1/5)
1. What is the main purpose of key rotation in Azure Key Vault?
easy
A. To share keys with other users
B. To delete all keys after use
C. To backup keys to local storage
D. To regularly change keys to improve security

Solution

  1. Step 1: Understand key rotation purpose

    Key rotation means changing keys regularly to reduce risk if keys are exposed.

  2. Step 2: Identify correct purpose in options

    Only To regularly change keys to improve security describes improving security by changing keys regularly.

  3. Final Answer:

    To regularly change keys to improve security -> Option D

  4. Quick Check:

    Key rotation = improve security by changing keys regularly [OK]
Hint: Key rotation means changing keys often for safety [OK]
Common Mistakes:
  • Thinking key rotation deletes keys
  • Confusing key rotation with key sharing
  • Believing key rotation backs up keys
2. Which Azure CLI command is used to rotate a key in Azure Key Vault?
easy
A. az keyvault key create
B. az keyvault key update
C. az keyvault key rotate
D. az keyvault key delete

Solution

  1. Step 1: Recall Azure CLI commands for key management

    To rotate a key, you create a new version using 'az keyvault key create'.

  2. Step 2: Match command to rotation action

    'az keyvault key rotate' does not exist; 'create' is correct for rotation.

  3. Final Answer:

    az keyvault key create -> Option A

  4. Quick Check:

    Rotate key = create new version command [OK]
Hint: Use 'create' command to rotate keys in Azure CLI [OK]
Common Mistakes:
  • Using 'update' instead of 'create' for rotation
  • Assuming 'rotate' is a valid CLI command
  • Confusing 'delete' with rotation
3. Given this Azure CLI command sequence:
az keyvault key create --vault-name MyVault --name MyKey --protection software
az keyvault key update --vault-name MyVault --name MyKey --ops encrypt decrypt sign verify

What is the expected result after running these commands?
medium
A. The key MyKey is deleted from MyVault
B. A new key named MyKey is created and its operations are updated
C. The key MyKey is backed up locally
D. An error occurs because update cannot change operations

Solution

  1. Step 1: Analyze the create command

    The first command creates a key named MyKey in MyVault with software protection.

  2. Step 2: Analyze the update command

    The update command changes the key's allowed operations to encrypt, decrypt, sign, and verify.

  3. Final Answer:

    A new key named MyKey is created and its operations are updated -> Option B

  4. Quick Check:

    Create then update key operations = success [OK]
Hint: Create key first, then update operations to rotate [OK]
Common Mistakes:
  • Thinking update deletes the key
  • Assuming update backs up the key
  • Believing update cannot change operations
4. You try to rotate a key using this command:
az keyvault key rotate --vault-name MyVault --name MyKey

But you get an error saying the command is not found. What is the likely cause?
medium
A. The 'rotate' command does not exist in Azure CLI for keys
B. The vault name is incorrect
C. The key name is missing
D. You need to delete the key before rotating

Solution

  1. Step 1: Check Azure CLI command availability

    Azure CLI does not have a 'key rotate' command for Key Vault keys.

  2. Step 2: Identify correct rotation method

    Rotation is done by creating a new version or updating the key, not by a rotate command.

  3. Final Answer:

    The 'rotate' command does not exist in Azure CLI for keys -> Option A

  4. Quick Check:

    No 'rotate' command in Azure CLI keys [OK]
Hint: No 'rotate' command; use update or create new version [OK]
Common Mistakes:
  • Assuming 'rotate' command exists
  • Blaming vault or key name for syntax errors
  • Trying to delete key before rotation
5. You want to automate key rotation in Azure Key Vault without downtime. Which approach is best?
hard
A. Export keys locally and re-import after rotation
B. Delete the old key and create a new key with the same name immediately
C. Create a new key version and update applications to use it before deleting old key
D. Manually update keys once a year during maintenance windows

Solution

  1. Step 1: Understand zero downtime rotation

    Creating a new key version allows apps to switch smoothly without service interruption.

  2. Step 2: Evaluate options for automation and safety

    Deleting keys immediately causes downtime; manual yearly updates risk security; exporting keys is insecure.

  3. Final Answer:

    Create a new key version and update applications to use it before deleting old key -> Option C

  4. Quick Check:

    New version + update apps = smooth rotation [OK]
Hint: Use new key version and switch apps before deleting old key [OK]
Common Mistakes:
  • Deleting old key before switching
  • Relying on manual yearly rotation
  • Exporting keys outside Key Vault