## TL;DR
Dynamic credential failures are almost always a bad role: wrong `creation_statements`, a broken database connection, or grants the DB user lacks. Read the role, read the connection config, and test credential generation directly. Fix the role and issuance works.

## Error
```text
vault database dynamic credentials failed: role misconfigured
```

## Steps
1. Read the role: run `vault read database/roles/` on the role name and inspect `creation_statements`, `default_ttl`, and `max_ttl`. Expected: you see the exact SQL or template Vault runs.
2. Read the connection: run `vault read database/config/` on the connection name and verify the plugin, connection URL, and allowed roles. Expected: the connection itself is healthy and the role is in `allowed_roles`.
3. Test issuance directly: run `vault write database/creds/` on the role name. Expected: either a username and password (role works, problem is elsewhere) or the real error.
4. Fix the usual suspects: quote identifiers correctly in `creation_statements`, grant the Vault admin user permission to create roles on the database, and match the statement syntax to the database engine version. Expected: the test issuance from step 3 succeeds.
5. Verify the generated credentials actually log in to the database. Expected: a manual login with the dynamic username and password works, proving end-to-end issuance.

## When to use
- `database/creds/` fails or applications cannot get dynamic credentials
- Setting up a new database role in Vault
- After a database upgrade changed SQL syntax

## When not to use
- Static role rotation failures (different mechanism)
- Connection-level errors (fix the `database/config` first)

## Tool compatibility
- HashiCorp Vault database secrets engine (postgres, mysql, and other plugins)

## Variant phrasings
### vault db creds permission denied creating user
The Vault admin database user lacks `CREATE ROLE` or equivalent; grant it on the database side.

### dynamic credentials work but app login fails
The creation statement may grant too little; check the generated user has the privileges the app needs.

## Why it happens
The database engine blindly executes the role's creation statements as the configured admin user. A syntax error, a missing grant on the admin user, or a role excluded from `allowed_roles` all surface at issuance time as a generic role failure.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1J3t_lwxQMW6SmRduCevpA