# Error accessing Vault - permission denied

**URL:** <https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297>\
**Category:** Vault\
**Tags:** vault\
**Created:** [November 1, 2022, 12:14pm UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297 "2022-11-01T12:14:24Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tech1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tech1/32/17018_2.png) [@tech1](https://discuss.hashicorp.com/u/tech1)\
**Post date:** [November 1, 2022, 12:14pm UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/1 "2022-11-01T12:14:24Z")

</div>

Hi  
We have setup a nodejs application to access vault secrets through an approle+secretId combination… It works fine sometimes but fails sometimes with - permission denied. And later after a few hours, with no code changes, it is working again…  
thanks

---

<div class="post-metadata">

**Author:** ![jlj7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jlj7/32/18330_2.png) [@jlj7](https://discuss.hashicorp.com/u/jlj7)\
**Post date:** [November 2, 2022, 10:09am UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/2 "2022-11-02T10:09:25Z")

</div>

I wonder whether it’s something to do with how you’ve configured the AppRole, maybe around TTLs? Could you share (sanitised) statements showing how you configured it?

---

<div class="post-metadata">

**Author:** ![tech1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tech1/32/17018_2.png) [@tech1](https://discuss.hashicorp.com/u/tech1)\
**Post date:** [November 2, 2022, 11:00am UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/3 "2022-11-02T11:00:58Z")

</div>

I am using settings from the default approle definition

---

<div class="post-metadata">

**Author:** ![jlj7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jlj7/32/18330_2.png) [@jlj7](https://discuss.hashicorp.com/u/jlj7)\
**Post date:** [November 2, 2022, 11:04am UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/4 "2022-11-02T11:04:16Z")

</div>

So, the settings as listed in [this DevDot tutorial](https://developer.hashicorp.com/vault/tutorials/auth-methods/approle-best-practices?in=vault%2Fauth-methods), you mean, for example?

```auto
vault write auth/approle/role/jenkins \
      secret_id_bound_cidrs="0.0.0.0/0","127.0.0.1/32" \
      secret_id_ttl=60m \
      secret_id_num_uses=5 \
      enable_local_secret_ids=false \
      token_bound_cidrs="0.0.0.0/0","127.0.0.1/32" \
      token_num_uses=10 \
      token_ttl=1h \
      token_max_ttl=3h \
      token_type=default \
      period="" \
      policies="default","test"

```

---

<div class="post-metadata">

**Author:** ![tech1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tech1/32/17018_2.png) [@tech1](https://discuss.hashicorp.com/u/tech1)\
**Post date:** [November 2, 2022, 11:16am UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/5 "2022-11-02T11:16:58Z")

</div>

![Screenshot from 2022-11-02 16-45-33](https://global.discourse-cdn.com/hashicorp/original/3X/6/0/604f70b85e32cdcb147af7c58e90075c26967b63.png)

---

<div class="post-metadata">

**Author:** ![tech1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tech1/32/17018_2.png) [@tech1](https://discuss.hashicorp.com/u/tech1)\
**Post date:** [November 3, 2022, 12:42pm UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/6 "2022-11-03T12:42:03Z")

</div>

Can you pls reply… We have already been using the vault in this configuration and have saved more than a dozen secrets in the kv store. And then we faced this issue and now unable to access the vault …

---

<div class="post-metadata">

**Author:** ![jeffsanicola](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffsanicola/32/18651_2.png) [@jeffsanicola](https://discuss.hashicorp.com/u/jeffsanicola)\
**Post date:** [November 3, 2022, 12:52pm UTC](https://discuss.hashicorp.com/t/error-accessing-vault-permission-denied/46297/7 "2022-11-03T12:52:56Z")

</div>

Do you have any [audit devices](https://developer.hashicorp.com/vault/docs/audit) enabled?

The audit logs can be reviewed to see which request(s) are failing and may provide some clues as to why it’s failing.