{"id":"5347f88b-f326-4e6d-9281-049f400f6cf3","task":"Configure HashiCorp Vault's database secrets engine to issue short-lived, auto-expiring PostgreSQL credentials to applications","domain":"developer.hashicorp.com","steps":["Enable the database secrets engine on a Vault mount path.","Configure the PostgreSQL connection, supplying the plugin name, connection URL, and a Vault-managed admin credential used to create dynamic users; optionally enable root credential rotation so Vault owns that admin credential going forward.","Create a role that maps a Vault role name to a creation SQL statement (granting login and a generated password with an expiration) plus default_ttl and max_ttl values controlling lease lifetime.","Applications request credentials by reading the role's creds path, receiving a unique username/password pair and a lease ID scoped to default_ttl.","Vault automatically revokes the database user when the lease expires or is explicitly revoked; clients should renew the lease before default_ttl elapses rather than assuming a connection stays valid indefinitely."],"gotchas":["The Vault-managed admin credential used to create dynamic users must itself hold sufficient database privileges (e.g., role/user creation) or credential generation fails.","If an application doesn't renew its lease before default_ttl expiry, Vault revokes the underlying database user even if a connection pool is still using it, so pools need lease-aware recycling.","Rotating the root/admin credential via Vault is typically one-way — the original static credential becomes unusable for manual access afterward."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/5347f88b-f326-4e6d-9281-049f400f6cf3"}