Vault error during 'updating' rotation schedule for database static role in DB secret engine


For an existing DB static role, we tried updating only Rotation TTL (from UI and API).
We are seeing the error {“errors”:[“cannot update static account username”]}

When we create a new role with same name and config details and a different Rotation TTL, then the role is updated with new Rotation TTL.

1 Like

I haven’t seen this error in our environment but I’m following along because there’s a chance it may affect us too. Have you opened a support ticket with hashicorp? Interested to hear what they say, because in theory it’s nothing more than a:

vault write database-mount/static-roles/my_db_static_user  \
    rotation_period="6h"

.. right?

As opposed to the delete/recreate:

vault delete database-mount/static-roles/my_db_static_user
vault write database-mount/static-roles/my_db_static_user \
    db_name=mydb \
    username="static_user" \
    rotation_period="6h"

Can you please share a bit more about your secrets engine config - or is the entire config in the first command? I will see if I can replicate.

found out this is s bug and got fixed in one of the future releases.

found out this is s bug and got fixed in one of the future releases. below is the github issue link

2 Likes