{"record":{"id":"0375ec4d853c3a2e","repo":"hashicorp/nomad","slug":"could-not-create-vault-role-w","errorCode":null,"errorMessage":"[✘] Could not create Vault role: %w","messagePattern":"\\[✘\\] Could not create Vault role: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/setup_vault.go","lineNumber":451,"sourceCode":"\t\treturn role, fmt.Errorf(\"[✘] Role data could not be deserialized: %w\", err)\n\t}\n\n\trole[\"bound_audiences\"] = vaultAud\n\n\treturn role, nil\n}\n\nfunc (s *SetupVaultCommand) createRole(role map[string]any) error {\n\tbuf, err := json.Marshal(role)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Role could not be interpolated with args: %w\", err)\n\t}\n\n\tpath := fmt.Sprintf(\"auth/%s/role/%s\", vaultPath, vaultRole)\n\n\t_, err = s.vLogical.WriteBytes(path, buf)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"[✘] Could not create Vault role: %w\", err)\n\t}\n\n\ts.Ui.Info(fmt.Sprintf(\"[✔] Created role %q.\", vaultRole))\n\treturn nil\n}\n\nfunc (s *SetupVaultCommand) policyExists() bool {\n\texistingPolicies, _ := s.vClient.Sys().ListPolicies()\n\treturn slices.Contains(existingPolicies, vaultPolicyName)\n}\n\nfunc (s *SetupVaultCommand) renderPolicy() (string, error) {\n\tsecret, err := s.vLogical.Read(\"sys/auth/\" + vaultPath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"[✘] Could not retrieve JWT accessor: %w\", err)\n\t}\n\taccessor := secret.Data[\"accessor\"].(string)\n","sourceCodeStart":433,"sourceCodeEnd":469,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/setup_vault.go#L433-L469","documentation":"After marshaling, createRole writes the role JSON to auth/<path>/role/<role> via Vault's logical WriteBytes API. If the write fails for any reason (auth, connectivity, permissions, invalid role config), the error is wrapped with this message.","triggerScenarios":"s.vLogical.WriteBytes(\"auth/<vaultPath>/role/<vaultRole>\", buf) returns an error: Vault unreachable, token lacks sudo/update on the auth role path, or the role config is rejected (e.g. bad bound_claims or policies).","commonSituations":"Vault token without sufficient policy; Vault sealed or unreachable; wrong -vault-path; role referencing a policy that doesn't exist; Vault in namespace mismatch.","solutions":["Verify the Vault token has update capability on auth/<path>/role/+","Confirm Vault address/namespace flags are correct and Vault is unsealed","Check the role JSON (e.g. token_policies referencing existing policies) is valid","Read the wrapped underlying Vault API error for the specific API response"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check: token capabilities\n// vault token capabilities auth/<path>/role/<role>  # expect: update","typeGuard":null,"tryCatchPattern":"var apiErr *api.ResponseError\nif err != nil && errors.As(err, &apiErr) {\n    // inspect apiErr.StatusCode / apiErr.Errors for the Vault rejection reason\n}","preventionTips":["Grant the setup token sudo/update on auth/*/role/*","Run vault status first to confirm connectivity and unsealed state","Ensure referenced token policies exist before creating the role"],"tags":["vault","api-write","permissions","network"],"backgroundTag":"vault-api-write-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}