# Key Vault Key rotation

**URL:** <https://discuss.hashicorp.com/t/key-vault-key-rotation/76537>\
**Category:** Azure\
**Created:** [September 19, 2025, 4:40pm UTC](https://discuss.hashicorp.com/t/key-vault-key-rotation/76537 "2025-09-19T16:40:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![msl0](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/msl0/32/35311_2.png) [@msl0](https://discuss.hashicorp.com/u/msl0)\
**Post date:** [September 19, 2025, 4:40pm UTC](https://discuss.hashicorp.com/t/key-vault-key-rotation/76537/1 "2025-09-19T16:40:20Z")

</div>

How to use azurerm\_key\_vault\_key automatic rotation?

1. When I deploy KV key using such code, the key does not have an expiration date, so I can assume it will never be rotated. Am I right?
2. When I rotated key via button “Rotate now” in rotation policy then TF wants to recreate KV key because the latest version of key after rotation contains expiration\_date, but in the code it’s not defined. Should I ignore expiration\_date?
3. If ingore\_changes if enough, then should I set expiration\_date during the creation of KV key so I dont need to use the “Rotate now” button?

```auto
resource "azurerm_key_vault_key" "this" {
  name = "encryption-key"
  key_vault_id = azurerm_key_vault.this.id
  key_type = "RSA"
  key_size = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]

  rotation_policy {
    automatic {
      time_before_expiry = "P30D"
    }

    expire_after = "P90D"
    notify_before_expiry = "P29D"
  }
}

```

```auto
...
      - expiration_date = "2025-12-18T16:21:29Z" -> null # forces replacement
...

```

The automatic rotation is not obvious to me, especially because Azure forces a minimum number of days in the rotation, so testing it is not easy. I’m unsure if it would be worth suggesting a change to this resource code in the provider or updating the documentation to make it clearer.

I would be grateful for any recommendations on how to create keys with automatic rotation via Terraform