The idea is that Vault creates/deletes/rotates the credentials that are used so the timeframe for exposure is limited. If your application can't re-connect to a database and drain the prior connection pool (or remove itself from a load balancer while restarting–whatever works for you) the credentials have to be long lived.

In that situation I would check out periodic tokens[0] since they live as long as they're renewed within the TTL.

0. https://www.vaultproject.io/docs/concepts/tokens.html#period...