App Service Resource Provider on Azure Stack Hub contains four secrets. Azure Stack Hub Operator needs to rotate these secrets.
The most important secret is Certificates. If you forget rotating these certificates, App Service RP and App Service on a tenant side don’t run normally. But the admin portal doesn’t alert the expiration of these certificates. Unfortunately, The admin portal can alert the only expiration of the deployment certificate. So Azure Stack Hub Operator needs to monitor the expiration of these certificates by themselves.
App Service RP on the admin portal shows you the expiration of these secrets. Furthermore, Azure Stack Hub Operator can get the expiration of these secrets by using Rest API. The URL is as follows.
GET https://adminmanagement.<region>.<FQDN>/subscriptions/<SubscriptionId> /providers/Microsoft.Web.Admin/locations/<Region>/secrets?api-version=2018-02-01"
It is good that Azure Stack Hub Operator can monitor the expiration with Rest API because the expiration should be monitored automatically. The sample script to monitor this expiration is as follows.