The Complete Production SOP: How to Deploy and Run HashiCorp Vault AppRole Dynamic Secret Leases in Autonomous AI Agents

---
name: "hashicorp-vault-approle-secrets"
description: "Authenticate applications and lease dynamic database credentials with HashiCorp Vault."
metadata:
  author: "HashiCorp"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "authenticate with vault approle"
  - "lease dynamic database credentials vault"
  - "use vault transit encryption"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# HashiCorp Vault AppRole Dynamic Secret Leases

Integrates HashiCorp Vault with AppRole authentication: role-id/secret-id exchange, dynamic database credentials with TTL leases, transit encryption, and automated secret renewal.

## Execution SOP & Rules
1. Authenticate using role_id and secret_id via POST /v1/auth/approle/login to obtain a client token.
2. Store the Vault token in memory; never write tokens to disk or log files.
3. Renew leased secrets before the lease TTL expires using sys/leases/renew.
4. Revoke leases immediately upon service shutdown to minimize credential exposure windows.

import axios from 'axios';

interface VaultAuthResponse {
  auth: {
    client_token: string;
    lease_duration: number;
    renewable: boolean;
  };
}

export class VaultLeaseManager {
  private clientToken: string | null = null;
  private vaultAddr: string;

  constructor() {
    this.vaultAddr = process.env.VAULT_ADDR || 'http://127.0.0.1:8200';
  }

  async authenticateAppRole(): Promise<void> {
    const response = await axios.post<VaultAuthResponse>(
      `${this.vaultAddr}/v1/auth/approle/login`,
      {
        role_id: process.env.VAULT_ROLE_ID,
        secret_id: process.env.VAULT_SECRET_ID
      }
    );
    this.clientToken = response.data.auth.client_token;
  }

  async renewLease(leaseId: string, incrementSeconds: number): Promise<void> {
    if (!this.clientToken) throw new Error('Unauthenticated: missing Vault token');
    await axios.post(
      `${this.vaultAddr}/v1/sys/leases/renew`,
      { lease_id: leaseId, increment: incrementSeconds },
      { headers: { 'X-Vault-Token': this.clientToken } }
    );
  }
}