← Problem Library
Security L7 SECURITY-1301 · 16 min

A Vault AppRole login succeeds and database credentials still expire early because the secret lease can never outlive the parent token TTL the app forgot to renew

The dynamic secret shows a long TTL, yet access fails much earlier because the underlying client token lifetime was shorter than the lease it obtained.

SecurityPlatform ReliabilityLevel 7Pro16 min
Scenario

An app authenticates with AppRole and later loses its dynamic credentials long before the advertised secret lifetime should end.

What to check first
  • Identify the primary failure signal in the Secret Lease Looked Long, Parent Token Was Short scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare secret TTL with parent token renewal behavior before changing the secret engine config.

Questions worth viewing together
What should you verify first when A Vault AppRole login succeeds and database credentials still expire early appears?

Community-field security problem inspired by HashiCorp Discuss threads where Vault AppRole users expected a secret lease to outlive the parent token. In Vault, a child lease can be bounded by the parent token even when the secret engine advertises a longer time.

What usually causes A Vault AppRole login succeeds and database credentials still expire early in production?

Teams often blame the database secret engine when the real expiry belongs to the login token.

What should you document after resolving A Vault AppRole login succeeds and database credentials still expire early?

Dynamic secrets inherit survival limits from the auth token chain above them.