I built a tool to stop Azure secret expiry outages — here's the checklist we use (and a demo to roast)

Hey r/devops,

I'll be upfront: I built a product called CertifyClouds to solve Azure secret lifecycle management. This post is the actual checklist we developed after dealing with this problem for years, and it works regardless of what tooling you use.

Why I built it — the pattern that kept repeating:

1. Someone creates a secret with a 1-year expiry
2. That person changes teams or leaves
3. There's no documentation, no alert, no handover
4. 11 months later: production goes down at 3 AM

After seeing this play out one too many times, I stopped trying to fix it with process and started building tooling. The checklist below is what we follow now, and it's what informed every feature in the product.

---

The Secrets Management Checklist

Discovery & Inventory

• Know every Key Vault you have — Across multiple subscriptions, things get created and forgotten. Run az keyvault list --query "[].name" across all subs quarterly at minimum.

• Know every secret in every vault — Not just "we have secrets", but a living inventory. Owner, purpose, what breaks if it dies.

• Tag everything — At minimum: owner, team, service-dependency, created-date. Future you will thank present you.

Expiration Management

• Set expiration dates on everything — Even if it's 5 years out. "No expiration" = "surprise at the worst time"

• Alert at 30, 14, and 7 days — Azure doesn't do this natively (WHY?), so you need Log Analytics + Alert Rules or a third-party solution.

• Have a rotation runbook — Not "we'll figure it out", but an actual documented procedure for each secret type (DB connection strings, API keys, certificates, etc.)

Ownership & Documentation

• No orphaned secrets — If the owner leaves, secrets get reassigned in the same sprint. Non-negotiable.

• Document dependencies — What services use this secret? What breaks? How do you rotate it? Put this in the Key Vault tags or a linked wiki.

• Review quarterly — 30 minutes every quarter to review expiring secrets and ownership. Put it in the calendar.

Access & Security

• RBAC, not access policies — If you're still using access policies, migrate to RBAC. Better audit trail, easier management.

• Managed identities where possible — One less secret to manage. App Services, Functions, Container Apps all support this.

• Audit who accessed what — Enable diagnostic logging to Log Analytics. When something goes wrong, you'll want this.

Disaster Recovery

• Soft delete enabled — Default now, but check your older vaults. 90-day recovery window has saved us twice.

• Know your backup strategy — Key Vault has soft delete, but what about cross-region? If UK South goes down, can you recover?

---

What the tool actually does

The checklist above is the manual version. CertifyClouds automates most of it:

• One-click discovery across all Key Vaults and subscriptions — secrets, certificates, and keys catalogued with expiry dates and dependencies
• Automated rotation for App Registration secrets and certificates (including B2C applications), with full-stack propagation to App Services, Functions, SQL, and Container Apps
• Multi-cloud sync — rotated in Azure, automatically synced to AWS Secrets Manager and GCP Secret Manager
• Blast radius analysis — before you rotate anything, see exactly what depends on it
• SOC 2 and ISO 27001 compliance scoring out of the box
• Zero-knowledge discovery — scanning reads metadata only (names, expiry dates, vault info). During rotation, new secrets are generated and propagated to dependent resources in memory — never stored or logged.

6-minute demo, no slides, just the real product: https://www.youtube.com/watch?v=E47UbTs3SZw

---

Roast it / Ask me anything

I'd genuinely rather get torn apart here than find out something's broken in production. So:

• What's missing? Tell me what I've got wrong or what's obviously absent.
• What's the biggest hole? Security concerns, architecture, trust issues — all fair game.
• What would you do differently? Always interested in how other teams are handling this.

I'll stick around and answer everything.

---

certifyclouds.com — Azure secret lifecycle automation. Discover, rotate, sync.