HashiCorp Vault Associate (003) Question 113
Single answer4b Describe how to renew leasesA team runs an application that reads database credentials from Vault's database secrets engine. During a maintenance window, the team notices the credentials are still valid but will expire soon. They want to extend the lifetime of the currently issued credentials without generating a new username and password. Which action should they take?
- A
Call the lease renewal endpoint or use
vault lease renew <lease_id>for the secret's lease ID - B
Re-run the original read against the database credentials path to automatically extend the existing lease
- C
Use
vault token renewbecause renewing the application's token also renews all dynamic secret leases created with that token - D
Update the database role's TTL settings and Vault will retroactively increase the TTL of the already issued credentials
Show answer and explanation
Correct answer: A
Explanation
In Vault, many dynamic secrets are returned with a lease ID, lease duration, and a renewable flag. If an application needs to keep using the same issued secret beyond its current TTL, it should renew the lease directly by using the lease renewal API or the CLI command vault lease renew. This differs from renewing a token with vault token renew, which only affects the token itself. It also differs from reading the secret again, which for dynamic secrets usually issues a new credential set rather than extending the existing one. As a best practice, applications should track lease metadata and renew secrets before expiration when the lease is marked renewable. HashiCorp Vault documentation on leases, dynamic secrets, and the vault lease renew command reflects this behavior.
- A. Correct.
Correct. Dynamic secrets issued by engines such as the database secrets engine are associated with a lease ID. To extend the validity of the currently issued secret, you renew that lease using the lease renewal API or CLI command such as
vault lease renew <lease_id>. This is the direct mechanism Vault provides for lease-based secret renewal when the lease is renewable and within the engine's limits. - B. Incorrect.
Incorrect. Reading the secret path again does not renew the existing lease. For dynamic database credentials, reading the path typically generates a new set of credentials and a new lease rather than extending the old one. This is a common misconception because users often assume a repeated read refreshes the same secret.
- C. Incorrect.
Incorrect. Token renewal and lease renewal are related but different operations. Renewing a client token extends the token's lifetime if the token is renewable, but it does not automatically renew already issued dynamic secret leases. Secret leases must be renewed separately using their lease IDs unless the client or application handles renewal explicitly.
- D. Incorrect.
Incorrect. Changing a role's TTL settings affects future leases issued under that role, not leases that have already been created. Existing leases keep the constraints established when they were issued and must still be renewed through the lease renewal process if renewal is allowed.