Understand Lease Management in HashiCorp Vault

Contributed by: Prachi Jain

Difficulty level: Intermediate

Lease management is an important feature of Vault, as it controls the lifecycle of secrets, tokens, and dynamic credentials. Every dynamic secret or service token issued by Vault has a lease. When Vault generates dynamic secrets (for example, database credentials), it attaches a lease duration. The lease can either expire or be renewed, giving you control over how long credentials live. Vault automatically revokes secrets when their lease expires, minimizing the risk of stale credentials floating around and enhancing overall security.

Important Terms

Below are some commonly used terms that you should be aware of:

Lease Time-to-Live (TTL)

Defines how long the secret or token is valid before it expires.

Renewal

Extends the validity of a lease before it expires.

Revocation

Explicitly invalidates the lease and destroys the associated dynamic secrets or credentials.

Example Setup in GCP

Let’s take an example of gcp secrets engine using roleset to understand lease generation with dynamic secrets and the various CLI commands associated with it:

1. Enable and configure gcp secrets engine:

   vault secrets enable gcp
   vault write gcp/config credentials=@/path/to/your/credentials.json

2. Create a gcp roleset:

   vault write gcp/roleset/shortcut-roleset project="your-project-id" secret_type="service_account_key" bindings='{"roles/viewer": ["serviceAccount:[e-mail]"]}' ...