You have a long-running app that cannot handle a regeneration of a token or secret. What type of token should be created for this application in…

Comprehensive and Detailed in Depth

For a long-running application that cannot handle token or secret regeneration, the Periodic Service

Token is the most suitable choice. According to HashiCorp Vault documentation, periodic service

tokens are renewable tokens that do not have a maximum Time-to-Live (TTL), meaning they can be

renewed indefinitely by the client without requiring manual intervention or regeneration. This is

ideal for applications needing continuous access to Vault over an extended period. The

documentation states: "Periodic tokens have a TTL, but no max TTL. Periodic tokens may live for an

infinite amount of time, so long as they are renewed within their TTL." This feature ensures

uninterrupted operation for long-running processes, aligning perfectly with the scenario described.

In contrast, a Service Token with Use Limit has a finite number of uses before expiration, making it

unsuitable for continuous access without regeneration. A Batch Token is designed for short-lived,

one-time operations or batch processes, not persistent access, as it lacks renewability and has a fixed

TTL. An Orphan Token, while not tied to a parent token, does not inherently address the regeneration

issue and is less secure for long-term use due to its lack of association with policies or identity. Thus,

the periodic service token stands out as the best fit.

Reference:

HashiCorp Vault Documentation - Tokens: Periodic Tokens