Vault dynamic DB secret "role not found" in CI

By Kaveh Alemi·Latchkey

A request for dynamic database credentials named a role the database secrets engine does not have. Vault returns "role not found" because no such role is configured on that mount.

What this error means

A vault read database/creds/<role> fails with "Code: 400 ... * role \"app-ci\" not found" or "unknown role".

$ vault read database/creds/app-ci
Error reading database/creds/app-ci: Error making API request.

URL: GET https://vault.example.com/v1/database/creds/app-ci
Code: 400. Errors:

* role "app-ci" not found

Common causes

The dynamic role was never created

No database/roles/app-ci exists on the mount, so Vault has no role to generate credentials from.

The mount path or role name is wrong

The engine is mounted elsewhere (like db/), or the role name in CI does not match the configured one.

How to fix it

Create the dynamic role on the right mount

1. Confirm the database mount with vault secrets list.
2. Create the role with its creation statements and DB connection.
3. Read <mount>/creds/<role> with a policy that allows it.

vault write database/roles/app-ci \
  db_name=appdb \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';" \
  default_ttl=1h max_ttl=2h

Read from the correct path

Match the mount and role name exactly, and grant read on the creds path.

vault read database/creds/app-ci

How to prevent it

• Keep dynamic role names in CI aligned with configured roles.
• Verify the database mount path with vault secrets list.
• Grant read on <mount>/creds/<role> in the CI policy.

Frequently asked questions

Related guides

References

• GitHub Actions documentation