Key Vaults no caller has touched in 30 days
What does ZopNight detect here?
Every secret read, key operation, and certificate request lands in a Key Vault's ServiceApiHit metric, so 30 days at 0 on both average and maximum means no caller depends on the vault. ZopNight also skips vaults younger than 30 days, and fires even at $0 cost because stale vaults are security surface.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1370 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | keyvault_unused.go |
Where it applies
One metric counts every kind of caller
ServiceApiHit on a Key Vault increments for every API operation: a secret GET, a key
signing call, a certificate list. That completeness is what makes it a trustworthy abandonment
signal: 30 days at zero, on both the average and the maximum, means no application, pipeline,
or admin touched the vault. Detection is metrics-only by design; a customer tag can never
authorize deleting a credential store.
The vault Azure zero-fills, and the age gate that counters it
Azure Monitor synthesizes a full-window zero series for a vault with no activity, which means a vault created yesterday reads as 30 silent days. The rule counters with an age gate: when the discoverer captured the vault’s creation timestamp, anything younger than the 30-day window abstains. The gate fails open. A vault with no timestamp is still evaluated, so a genuinely stale orphan is never spared by missing metadata.
Why this fires at zero dollars
Key Vault has no base fee; Azure charges per operation, so an untouched vault often computes to $0. The rule fires anyway (orphan cleanup is exempt from ZopNight’s minimum-savings filter) because the value is risk reduction: a forgotten vault full of live credentials is attack surface, audit noise, and a compliance question nobody can answer.
Audit a vault’s pulse
az monitor metrics list \ --resource "$(az keyvault show -n <vault> --query id -o tsv)" \ --metric ServiceApiHit \ --interval PT1H --offset 30d --aggregation Average MaximumThe soft-delete safety net
Deleting a vault is less final than it sounds: soft delete retains it for the configured
retention period (7 to 90 days), during which az keyvault recover restores everything. Export
secrets you know you need, delete, and treat the retention window as your rollback plan. If a
forgotten consumer surfaces, recovery is one command.
Abstain list and access
Metrics fetched for the org but absent for this vault, any recorded hit, or a known-young vault each suppress the finding. Reader and Monitoring Reader are sufficient to reproduce the detection; ZopNight has no write access to vault contents at any point.