Azure Key Vault: Rotation Policies

Static secrets are a risk. If a developer checks a connection string into GitHub, you are compromised. The solution is Key Rotation.

Automated Rotation

Azure Key Vault can automatically rotate secrets near expiry. For example, it can:

• Trigger an Event Grid event.
• Call an Azure Function.
• The Function talks to SQL Server to reset the password (`ALTER LOGIN`).
• The Function updates Key Vault with the new password.

This creates a “Zero Standing Privileges” environment. No human knows the DB password, and it changes every 30 days automatically.