Key Vault Scan¶

The Scan reads all Azure Key Vaults across your subscriptions to inventory secrets, keys, and certificates with expiration tracking.

Overview¶

The Scan provides a centralized view of all vault contents across your Azure environment:

• Multi-subscription scanning: Scan all Key Vaults across multiple Azure subscriptions
• Complete inventory: Secrets, keys, and certificates with metadata
• Expiration tracking: Visual indicators for healthy, warning, and critical status
• Historical data: Track changes over time with scan history
• Delta scanning: Efficient updates using cached data
• Enterprise Application monitoring: The rotation-discovery run inventories service-principal credentials and owners. See Enterprise Applications (monitor-only)

What Gets Scanned¶

Secrets¶

Keys¶

Certificates¶

Running a Scan¶

From the UI¶

1. Navigate to Assets → Scan
2. Click Run Scan
3. Select scan mode:
4. Full Scan: Complete refresh of all data
5. Delta Scan: Only fetch changes (faster)
6. Monitor progress in real-time
7. View results when complete

Via API¶

# Start a full scan
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "full"}'

# Start a delta scan (faster)
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "delta"}'

Scan Modes¶

Expiration Status¶

CertifyClouds categorizes assets by expiration status:

Configuring Thresholds¶

Thresholds are configurable per alert rule:

1. Go to Settings > Alerts
2. Create or edit an expiring secrets rule
3. Set your preferred threshold (e.g., 14, 30, 60 days)

Scan Results¶

Dashboard View¶

The Assets dashboard shows:

• Total Assets: Count by type (secrets, keys, certificates)
• Expiration Distribution: Donut chart of healthy/warning/critical
• Recent Scans: History with duration and counts
• Vault List: All vaults with asset counts

Asset Details¶

Click any vault to see:

• Vault Properties: Name, location, resource group, SKU
• Access Configuration: RBAC vs Access Policies
• Network Settings: Public/private access, firewall rules
• Asset List: All secrets, keys, and certificates

Export Options¶

Export scan results in multiple formats:

• JSON: For automation and integration
• CSV: For spreadsheets and reporting
• PDF: For compliance documentation

Scan Performance¶

Configuration¶

Tune scan performance via Settings > Advanced or environment variables:

Performance Tips¶

1. Use Delta Scans: For regular monitoring, delta scans are significantly faster
2. Reduce Workers: If hitting Azure API rate limits, reduce max workers
3. Subscription Filtering: Scan only needed subscriptions to reduce time
4. Schedule Off-Peak: Run full scans during low-usage periods

Typical Scan Times¶

Scheduled Scanning¶

CertifyClouds can automatically run Key Vault scans on a schedule:

Configure Schedule¶

Key Vault scanning runs on a background worker. You need an admin account to change it.

1. Go to Settings → Advanced → Workers
2. Under Scan & Discovery Workers, find Assets Scan
3. Turn on Auto-scan
4. Pick how often it runs: every 30 minutes, 1, 2, 4, 6, 12 or 24 hours

The change saves as soon as you make it. There is no cron expression field. The card shows when the scan last ran and whether the worker is enabled. Non-admin users see the same card without the controls.

Scheduled runs are always full scans. Delta mode is available on manual scans and through the API, not on the schedule.

Best Practices¶

• Run at least once daily for compliance monitoring
• Monitor scan history for performance trends

Filtering and Search¶

Filter Options¶

Search¶

Search across all assets by:

• Name (partial match)
• Tags (key or value)
• Content type
• Vault name

Troubleshooting¶

"Access denied" for some vaults¶

Cause: CertifyClouds doesn't have read permissions on the vault.

Fix: Run the setup script to grant permissions:

./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID --apply

"Network unreachable" errors¶

Cause: Key Vault has firewall enabled and CertifyClouds IP is blocked.

Fix: Add your subnet to the vault's firewall rules, or use private endpoints.

Slow scan times¶

Cause: Too many concurrent workers hitting rate limits.

Fix: Reduce DISCOVERY_MAX_WORKERS to 3 or lower.

Missing subscriptions¶

Cause: CertifyClouds doesn't have Reader role on the subscription.

Fix: Grant Reader role at subscription scope:

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role Reader \
  --scope /subscriptions/<subscription-id>

API access¶

Scan endpoints are listed in API Endpoints; exact request and response shapes are in your deployment's /docs.

Best Practices¶

1. Run Regular Scans: Schedule daily delta scans for continuous monitoring
2. Act on Critical: Address critical expiration items immediately
3. Set Up Alerts: Configure email/webhook alerts for expiring assets
4. Review Compliance: Check compliance score after each scan
5. Archive History: Keep scan history for audit trails