Rotation Service Principals Inherit Key Vault Purge

The Trap

Purge permission granted alongside delete in Key Vault legacy access policies, applied to the same service principal that performs automated secret rotation.

The Default State

Most Terraform modules and sample az keyvault set-policy commands copied from vendor documentation list secret_permissions as ["get","list","set","delete","purge"] as a single block, because the examples were written for administrators, not automation. Engineers building CI/CD pipelines paste this block wholesale onto the rotation service principal rather than stripping it down. Compounding this, a newly created vault ships with enablePurgeProtection set to false unless explicitly overridden, so soft-delete exists but carries no immutability guarantee against an identity that already holds the purge action.

The Blast Radius

Soft-delete is meant to give a 90-day recovery window after a secret is deleted. Purge permission bypasses that window entirely: a call to Remove-AzKeyVaultSecret -InRemovedState Purge, or the equivalent REST DELETE against the deletedsecrets endpoint, destroys every version of the secret immediately and irreversibly. If the rotation script has a logic fault, retries against a stale secret name, or the service principal’s credential is exfiltrated, an attacker or a bad deployment can purge connection strings, TLS certificates, or encryption key material with a single authenticated call. There is no backup path unless the value was exported offline beforehand. Dependent workloads referencing the deleted version fail permanently, and the audit trail of prior secret versions, often relied upon for forensic reconstruction after a breach, is gone with it.

The Lead Mechanic Fix

Enable purge protection on the vault itself so the setting becomes immutable for the retention period: az keyvault update --name --enable-purge-protection true. This cannot be reversed once set, which is the point. Separately, remove purge from every application-facing access policy: az keyvault set-policy --name --spn --secret-permissions get list set delete, omitting purge entirely. Migrate the vault to Azure RBAC and assign automation identities the Key Vault Secrets Officer role, which excludes purge actions, reserving Key Vault Administrator for break-glass access gated behind Privileged Identity Management with time-bound activation and approval.