vault lease renew and revoke: Manage Leases
vault lease renew extends the TTL of a dynamic secret lease, and vault lease revoke ends it immediately.
Dynamic secrets (database creds, PKI certs, cloud keys) come with a lease. A long job renews its lease to keep credentials alive; teardown revokes the lease to clean up the backend.
What it does
Every dynamic secret has a lease_id and a TTL. vault lease renew extends it (optionally by -increment, bounded by the max TTL). vault lease revoke invalidates it, which also tears down the backing resource (for example dropping the database user). -prefix revokes all leases under a path.
Common usage
vault lease renew database/creds/ci/abcd1234
vault lease renew -increment=3600 database/creds/ci/abcd1234
# revoke a single lease
vault lease revoke database/creds/ci/abcd1234
# revoke everything under a mount (sudo)
vault lease revoke -prefix database/creds/ciOptions
| Flag | What it does |
|---|---|
| <lease_id> | The lease to renew or revoke |
| -increment=<seconds> | Requested renewal duration |
| -prefix | Revoke all leases under a path (sudo) |
| -force | Revoke locally even if the backend call fails |
In CI
For jobs longer than the default lease TTL, renew periodically or request a longer initial TTL. Always revoke at teardown so dynamic credentials do not linger; relying on TTL expiry alone leaves valid creds active until they expire. The lease_id is returned in the secret response when it was created.
Common errors in CI
"lease not found" or "invalid lease ID" means the lease already expired or was revoked, or the id is mistyped. "lease is not renewable" means the secret type or role disabled renewal; request a longer initial TTL instead. "cannot renew lease beyond max TTL" means you hit the ceiling; the credential must be reissued. -prefix needs sudo on sys/leases/revoke-prefix.