encryptionhashicorp-vaultvaulthashicorp

Vault transit engine key lease duration

I see the following output after creating a key with HashiCorp vault’s transit engine using vault write -f transit/keys/transit_key exportable=true command-

...
“lease duration”: 0,
“lease_id”: “”,
“renewable”: false
...

Does this mean that the key is valid for infinity?

Solution

  • Yes, that's right. A lease duration of 0 would mean the key wouldn't expire and valid for infinity.

    Though it is generally not a good security practice to set a lease duration of 0.