HashiCorp - Vault Associate Study Guide

4: Vault leases

Every dynamic credential, wrapping token, and revocable secret that flows out of Vault is anchored to a lease record with its own identifier, time-to-live counter, and revocation callback registered against a secrets engine. This chapter defines the lease ID as the sole handle a consumer holds against Vault's expiration manager, walks through renewal semantics that stretch or clamp that clock without exceeding maximum bounds, and covers the single-lease, prefix, and force revocation paths that let operators tear down individual credentials or entire families of leased secrets in one call.