# Key Vault Secret

> Key Vault secrets hold credentials, connection strings, and API keys consumed by applications, and carry no meaningful direct cost. ZopNight enumerates them as child resources of each vault with metadata only (name, dates, expiry), so staleness and rotation posture are visible while secret values are never read.

Source: https://zop.dev/integrations/azure/secret
Updated: 2026-08-19

---

Key Vault secrets store credentials, connection strings, and API keys consumed by applications. Secret metadata reveals staleness and expiry posture across an environment.

## Cost lives at the vault; risk lives at the secret

An individual secret adds no line to the bill. The transactions that read it are metered on the parent vault, and storing one more secret costs nothing measurable. What a secret does carry is operational risk, and that risk is legible entirely from metadata: a created date years in the past signals a credential that has never rotated, a missing expiry means nothing will ever force that rotation, and an expiry that already passed suggests either a broken consumer or a dead entry nobody cleaned up. Reading the values is never necessary to see any of this.

## Enumeration as vault children, metadata only

ZopNight discovers secrets through Azure Resource Graph and Key Vault enumeration, modelling each as a child of its vault. Only metadata is inventoried: name, creation and update dates, expiry. Secret values are never accessed. That boundary is deliberate: hygiene review needs the envelope, not the contents, and a cost platform holding plaintext credentials would itself be a finding. Secrets are discovery-only in scheduling terms; there is no action to take on one beyond what its metadata argues for: rotate, set an expiry, or delete.

## Reading an environment's rotation posture

Fleet-wide, the metadata tells stories single secrets cannot. A vault where every secret shares one creation date usually marks a migration snapshot that has aged untouched since. Clusters of never-expiring secrets map the services excluded from rotation policy. And entries whose names reference decommissioned systems are deletion candidates hiding in plain sight, each one a credential that still works somewhere nobody is watching.

## Where a secret's dates are shown in the portal

Azure portal → Key vaults → select the vault → Objects → Secrets lists every secret; opening one shows its versions with created, updated, activation, and expiration attributes. The values stay behind a separate, audited show-value action.