Issue Dynamic Database Credentials with Vault

Configure a database secrets engine so each application instance gets a short-lived credential it does not have to store, and revoke on lease expiry.

~50 minsecuritysecretsdatabases

Task

Replace static database passwords with short-lived credentials generated on demand.

When to use this

A shared database password is stored in many places and never rotated, so one leaked config grants long-lived database access.

Prerequisites

A Vault server with the database secrets engine
A database role defining privileges

Steps

1. Configure the database secrets engine with a privileged connection.

Expected output: Vault can create and revoke database users.

2. Define a role with the exact privileges the application needs.

Expected output: Issued credentials have least privilege.

3. Have the application request a credential and refresh it before the lease expires.

Expected output: No static password is stored.

4. Rely on Vault to revoke generated users when leases expire.

vault read database/creds/app-role

Expected output: Unused credentials disappear automatically.

Troubleshooting

Problem

Lease expires mid-use

Solution

Refresh ahead of expiry with a safety margin; handle renewal failure by reconnecting with a new credential.

Problem

Too many database users accumulate

Solution

Migrations and revocation must be enabled; check for leaked leases and fix the engine config.

Limitations

Dynamic secrets add a dependency on Vault availability during credential acquisition and renewal.
They require database privileges for Vault to manage users, which must itself be carefully controlled.

Context

Replace static database passwords with short-lived credentials generated on demand. A shared database password is stored in many places and never rotated, so one leaked config grants long-lived database access.

Steps

Configure the database secrets engine with a privileged connection. Expected: Vault can create and revoke database users.
Define a role with the exact privileges the application needs. Expected: Issued credentials have least privilege.
Have the application request a credential and refresh it before the lease expires. Expected: No static password is stored.
Rely on Vault to revoke generated users when leases expire. Expected: Unused credentials disappear automatically.

vault write database/config/app plugin_name=postgresql-database-plugin
vault write database/roles/app-role db_name=app default_ttl=1h max_ttl=24h
# creation_statements template issues a short-lived role per request

Verify

Vault can create and revoke database users.
Issued credentials have least privilege.
No static password is stored.
Unused credentials disappear automatically.

Limits

Dynamic secrets add a dependency on Vault availability during credential acquisition and renewal.
They require database privileges for Vault to manage users, which must itself be carefully controlled.