Vault Token Expiring

Vault
1

I have a workflow wherein I am generating Vault tokens via terraform. While I am setting both the ttl and period arguments to “768h”, the tokens seem to disappear after 20 minutes. I’ve tried multiple policy assignments (including no policies), tried with and without the default policy assignment, with and without period (only ttl) but no matter what I try, the token always gets revoked after 20 minutes. I’m not sure if it’s important, but the token is revoked regardless of whether or not it’s been used.

Here is a code snippet for how I am creating the token:

resource “vault_token” “example” {
period = “768h”
ttl = “768h”
}

output “token” {
value = vault_token.example.client_token
}

Any help would be appreciated as I’m a bit puzzled at the moment :slight_smile:

2

Hi! Just thinking out loud here, but, as you aren’t creating orphan tokens, isn’t each one you create this way tied to the TTL of the (parent) token Terraform is using? How are you creating that token?

1 Like
3

For this test, the token I’m using with the terraform provider is the initial root token.

4

I ran some more tests with both terraform and using the vault cli.

Via the cli (using command: vault token create -policy=policy-terraform-azure-us-infrastructure-nonprod), the token does NOT expire prematurely.

via api
Key Value

accessor V9VscJA4BKClDV39u9dbw4DO
creation_time 1608249503
creation_ttl 768h
display_name token
entity_id n/a
expire_time 2021-01-18T18:58:23.9558101-05:00
explicit_max_ttl 0s
id s.qFidqi9u1YMbvHx1G7pl86tm
issue_time 2020-12-17T18:58:23.9558243-05:00
meta
num_uses 0
orphan false
path auth/token/create
policies [default policy-terraform-azure-us-infrastructure-nonprod]
renewable true
ttl 767h26m55s
type service

When creating the token via terraform, the it will be revoked after 20 minutes:

Key Value

accessor 9BIFNxQLNsySQMh1OmLJUM08
creation_time 1608258318
creation_ttl 768h
display_name token-token
entity_id n/a
expire_time 2021-01-18T21:25:18.9475961-05:00
explicit_max_ttl 0s
id s.RgoFkiKBbkMjmC1S9Qn3XYXm
issue_time 2020-12-17T21:25:18.9476091-05:00
meta
num_uses 0
orphan false
path auth/token/create
policies [default policy-terraform-azure-us-infrastructure-nonprod]
renewable true
ttl 767h40m45s
type service

I’m not seeing a difference between the two.

5

Me either. I think you may have found a bug in the provider:

6

great find, that seems like exactly what I’m experiencing.

1 Like
7

IRRC, when terraform runs, it doesn’t actually use the token you set in the provider (regardless of if you set via env variable or directly etc), to actually write to vault / read.
Rather what it does is it uses that token, to generate a new token which has a shorter TTL (intermediate token) https://registry.terraform.io/providers/hashicorp/vault/latest/docs#max_lease_ttl_seconds .
This token acts like any other token, ie, if you create a child token of this token, then the child token will be linked to the TTL of the intermediate token.
You can therefore add the no_parent flag when creating your token : https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/token#no_parent
hope this helps

1 Like