Vault AppRole "invalid role or secret id" in CI

By Daniel Zoghalchali·Latchkey

AppRole login rejected the credential pair. Either the role_id or secret_id is wrong, the secret_id TTL expired, or its use count is exhausted. Vault returns a single generic error to avoid leaking which half is wrong.

What this error means

A vault write auth/approle/login call fails with "Code: 400 ... * invalid role or secret id", while VAULT_ADDR is reachable.

$ vault write auth/approle/login role_id="$ROLE_ID" secret_id="$SECRET_ID"
Error writing data to auth/approle/login: Error making API request.

URL: PUT https://vault.example.com/v1/auth/approle/login
Code: 400. Errors:

* invalid role or secret id

Common causes

The secret_id expired or hit its use limit

A secret_id with a short secret_id_ttl or a secret_id_num_uses cap becomes invalid once expired or used up, so login fails.

The role_id/secret_id secret is stale or swapped

The CI secret holds an old secret_id, a role_id from a different role, or the two were pasted into the wrong variables.

How to fix it

Issue a fresh secret_id and update the CI secret

1. Generate a new secret_id for the role.
2. Store it (and the matching role_id) in CI secrets.
3. Re-run the login.

vault read auth/approle/role/ci/role-id
vault write -f auth/approle/role/ci/secret-id

Give the secret_id enough TTL and uses for CI

Set the role so a secret_id survives between rotations and allows the login count you need.

vault write auth/approle/role/ci \
  secret_id_ttl=24h secret_id_num_uses=0 token_policies="ci-read"

How to prevent it

• Rotate secret_id on a schedule and update the CI secret in one place.
• Avoid ultra-short secret_id_ttl that expires between pipeline runs.
• Keep role_id and secret_id in clearly named, separate secrets.

Frequently asked questions

Related guides

References

• GitHub Actions documentation