feat: explicit max ttl for secrets

[gsantos-hc]

Overview

Add explicit_max_ttl to Azure role attributes. When set, Application Secrets in Azure AD will be created with a maximum lifetime equal to explicit_max_ttl, instead of the hard-coded 10-year default in effect until now.

This enables organizations with compliance requirements to limit secret lifetimes to implement a hard ceiling on the secret's lifetime. This also serves as a backstop against the possibility of Vault failing to revoke the secret when the lease expires.

Design of Change

How was this change implemented?

Related Issues/Pull Requests

• Fixes Azure secrets engine, ability to specify static SPN secret expiry #178
• Fixes VAULT-12316

Contributor Checklist

• Add relevant docs to upstream Vault repository, or sufficient reasoning why docs won’t be added yet: Example
• Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
• Backwards compatible

[gsantos-hc]

One thing missing from this is communicating to the client that the secret won't be renewed beyond its initial explicit_max_ttl. Any ideas for that? Maybe the lease could be marked non-renewable when the remaining lifetime under explicit_max_ttl is less than the role's TTL?

[Zlaticanin]

Thank you for working on this! 👏 Everything looks good to me. I am currently testing it locally, not running into any issues so far. As for the secret renewal, I think that it makes sense for it not to be renewed if < role's ttl, we just need to make sure we document it as well.

[gsantos-hc]

Force-pushed to rebase from main and leverage min in Go 1.21

[Zlaticanin]

Can we please add changelog entry?

We can update CHANGELOG.md file, we can add an entry here, something like

FEATURES:

* Adds ability to set `explicit_max_ttl` to specify the expiration for secrets associated with service principals [[GH-199]](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/199)

After the PR is merged, I will open a PR on Vault side to update the documentation.

[gsantos-hc]

Thanks for reviewing and testing, @Zlaticanin. I've updated the changelog.

[gsantos-hc]

Force-pushed to rebase from the latest main and squash commits

[Zlaticanin]

LGTM! Thank you for working on this! 🎉

After we merge this, I will update the docs