Vault operations are mostly about lifecycle control: who received a secret, how long it is valid, when it renews, and how quickly it can be revoked.
Tokens and leases are not implementation details. They are the operational handles for incident response.
Token Practices
Use short-lived and renewable tokens where possible. Avoid long-lived service tokens unless there is a documented reason.
Token expectations:
- root tokens are not used for normal administration.
- human tokens come from an auth method.
- automation tokens are scoped and rotated.
- orphan and periodic tokens are reviewed carefully.
- token accessors are treated as sensitive operational data.
Lease Practices
Dynamic secrets have leases. Consumers must renew or replace them before expiry.
Useful commands:
vault lease lookup <lease-id>
vault lease renew <lease-id>
vault lease revoke <lease-id>
vault lease revoke -prefix <path-prefix>
Prefix revocation is especially useful when a system or path is compromised.
Audit And Recovery
Audit logs should be enabled before production use and routed to protected storage.
Recovery expectations:
- encrypted backups.
- restore testing.
- documented unseal or recovery-key process.
- revocation runbook for compromised paths.
- incident process for suspicious token activity.
Acceptance Criteria
- root token is controlled and not used casually.
- dynamic secret TTLs match workload needs.
- audit logs are protected from application teams.
- revocation is tested.
- backups can be restored by named operators.
References
- Vault documentation: Tokens.
- Vault documentation: Lease, Renew, and Revoke.
- Vault documentation: Audit Devices.