## TL;DR

A dynamic secret's lease expired because nothing renewed it in time. Renew leases on a schedule inside their TTL, and when the max TTL is reached, fetch a fresh credential instead of renewing.

## Error

```text
vault dynamic secret failed to renew: lease expired error
```

## Steps

1. Check the lease's TTL and max TTL. Expected: you see how much life was left.
2. Set up renewal on a timer at a fraction of the TTL (half is typical). Expected: renewals happen well before expiry.
3. Handle the max-TTL case: renewal past it fails, so the code must request a new credential. Expected: no outage at max TTL.
4. Confirm the renewing token itself has permission to renew and is not expired. Expected: the renew call is authorized.
5. Monitor lease lifetimes and alert before expiry. Expected: early warning next time.

## When to use

- Database or cloud dynamic credentials expiring unexpectedly.
- Apps that hold long-lived dynamic secrets.

## When not to use

- Static kv secrets (no leases).
- Initial issuance failures (different problem).

## Tool compatibility

- Vault dynamic secret engines; lease and token TTLs.

## Variant phrasings

### vault lease expired on dynamic secret

Same renewal fix.

### dynamic credentials stopped working

Check lease state.

## Why it happens

Dynamic secrets are rented, not owned. The lease must be actively renewed, and everything has a max TTL after which renewal is impossible.

## Edge cases

- The renewing process dying silently is the classic cause; supervise it.
- Clock skew can make a valid lease look expired; check time sync.
- Some engines do not support renewal at all; those always need re-issuance.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8fB1HhxUp1b09WybsOciuA