Vault Associate: Manage Vault Leases

What a lease is

A lease is Vault's promise that a secret or token stays valid for a period. Dynamic secrets always carry lease_id, lease_duration, and renewable. Tokens are also leases - that is why revoking a token revokes the credentials it generated.

Lifecycle operations

• vault lease lookup <lease_id> - inspect issue time, expiry, and renewability.
• vault lease renew <lease_id> or -increment=1h - request additional time.
• vault lease renew -prefix database/creds/ - renew many leases at once.
• vault lease revoke <lease_id> - revoke one lease; for a database engine this drops the user.
• vault lease revoke -prefix aws/creds/ - revoke everything beneath a path.

Revocation is immediate and, for dynamic engines, performs cleanup at the target system (DROP USER, revoke IAM keys). Renewal is capped by the engine's max_lease_ttl, set at mount time or in engine config; once a lease reaches that cap it cannot be renewed and must be re-obtained.

Traps

• KV secrets have no lease and cannot be renewed.
• Renewing extends TTL by the increment but never past max_ttl.
• Revoking a token cascades to its child tokens and their leases.
• Leases also expire silently by TTL; clients must handle 403s and re-authenticate.
• lease_duration of 0 means non-expiring, not expired.

Rule of thumb: treat every dynamic credential as a lease - renew before expiry, revoke when finished, and remember that revoking the parent token cleans up everything beneath it.