$ cc-scan CertifyClouds Scanner v1.4.0 · Azure Key Vault security audit [email protected] Scanning Azure subscriptions... Production (sub-abc-123) ├── vault-prod (eastus): 12 secrets, 3 certificates, 2 keys └── vault-staging (westeurope): 8 secrets, 1 certificate, 0 keys ──────────────── SUMMARY ──────────────── Subscriptions: 1 Vaults: 2 Total assets: 26 Secrets: 20 Certificates: 4 Keys: 2 EXPIRY WARNINGS EXPIRED 3 secrets, 1 certificate < 30 days 2 secrets SECURITY FINDINGS CRITICAL: 3 MEDIUM: 2 INFO: 4
What You Get
Full Vault Inventory
Scan every Key Vault across all subscriptions. Secrets, certificates, and keys with expiry dates, status, and metadata.
14 Security Checks
Expired secrets still enabled, public network access, missing soft delete, no RBAC, standard SKU, and more.
Multiple Formats
Rich terminal tables, JSON for pipelines, CSV for spreadsheets, standalone HTML reports with charts.
CI/CD Ready
Exit code 1 on critical or high findings by default. Use --fail-on to choose your gate for GitHub Actions, Azure DevOps, or another pipeline.
No Service Principals
Uses your existing Azure CLI session: no service principals to provision or rotate. Just az login and cc-scan. Your Azure account needs Reader and Key Vault Reader (see the FAQ).
Privacy First
Runs locally. Never reads secret values. Only sends aggregate counts for telemetry. Use --offline to disable entirely.
Up and Running in Minutes
Install
pip install certifycloudsAuthenticate
az loginScan
cc-scanFirst run prompts for email to register a free API key. That's it.
Security Checks
Every scan runs 14 checks against your vaults and assets:
| Severity | Check | What It Finds |
|---|---|---|
| CRITICAL | SEC-001/002 | Expired secrets or certificates still enabled |
| CRITICAL | SEC-012 | Expired keys still enabled |
| HIGH | SEC-003 | Public network access enabled on vault |
| HIGH | SEC-004/005 | Soft delete or purge protection disabled |
| MEDIUM | SEC-006/007 | Secrets or certificates with no expiry date set |
| MEDIUM | SEC-013 | Keys with no expiry date set |
| MEDIUM | SEC-008 | RBAC authorization not enabled on vault |
| LOW | SEC-009 | Standard SKU (no HSM backing) |
| INFO | SEC-010/011 | Secrets or certificates expiring within 30 days |
| INFO | SEC-014 | Keys expiring within 30 days |
Scanner Finds Problems. Pro Fixes Them.
The scanner is step one. CertifyClouds Pro automates everything after that.
| Capability | Scanner (Free) | Pro |
|---|---|---|
| Vault discovery & inventory | ✓ | ✓ |
| Expiry tracking | ✓ | ✓ |
| Security findings | ✓ | ✓ |
| JSON / CSV / HTML reports | ✓ | ✓ |
| Continuous monitoring & dashboards | - | ✓ |
| TLS certificates on App Service, Front Door and other Azure services | - | ✓ |
| Automated secret rotation | - | ✓ |
| Dependency mapping | - | ✓ |
| Multi-cloud sync (AWS / GCP) | - | ✓ |
| Compliance score (0-100) | ✓ | ✓ |
| Audit trail | - | ✓ |
| Email & webhook alerts | - | ✓ |
Occasional emails. No spam. Unsubscribe at any time.
Frequently Asked Questions
Yes, completely free, no trial expiry. Register with your email and scan unlimited vaults, forever. We built it to help Azure teams find expiring secrets before they cause outages.
Aggregate counts only: subscriptions, vaults, secrets, certificates, keys, how many have expired, how many expire in 8 to 30 days, how many vaults errored, and scan duration. Plus your scanner version. Never your vault names, secret values, or any identifiable infrastructure details. Use --offline to disable all telemetry.
Behind a firewall, yes: it needs to reach Azure's APIs and, unless you use --offline, license.certifyclouds.com for registration and the post-scan check. It cannot run air-gapped, because it reads your vaults through Azure's APIs.
Reader role on your subscriptions (to discover vaults and read their settings) and Key Vault Reader on each vault that uses Azure RBAC. Vaults that use access policies need List on secrets, certificates and keys, plus Get on certificates. The scanner never reads secret values, only expiry dates and metadata.
The scanner is a read-only, point-in-time audit tool. CertifyClouds Pro adds continuous monitoring, TLS endpoint monitoring, automated rotation, dependency mapping, multi-cloud sync, compliance evidence packages, and alerting. The scanner tells you what's wrong; Pro helps you fix it.
Yes. Set CC_SCAN_KEY and use --format json. In precedence order, exit 2 means the scan failed or read nothing, 3 means registration could not complete, 1 means a finding at or above --fail-on (default high), 4 means the scan finished with coverage gaps, and 0 means none of those apply.