hashicorp/vault · error · Error

Could not update allowed roles for selected database: ${e.er

Error message

Could not update allowed roles for selected database: ${e.errors.join(', ')}

What it means

Thrown by the Vault UI's Ember Data adapter for database secrets engine roles (ui/app/adapters/database/role.js:222). Before creating or deleting a role, the adapter calls _updateAllowedRoles(), which loads the parent database connection record, adds/removes the role name from its allowed_roles list, and saves the connection. If that preliminary connection save fails with any HTTP status other than 403, checkError() rethrows with the joined error strings. A 403 is deliberately swallowed because a user whose policy only covers roles (not the connection) must still be able to save the role itself.

Source

Thrown at ui/app/adapters/database/role.js:222

      data = {
        ...serializedData,
        username: snapshot.attr('username'), // username is required for updating a static role
      };
    } else {
      data = serializedData;
    }

    return this.ajax(this.urlFor(backend, id, roleType), 'POST', { data }).then(() => data);
  },

  checkError(e) {
    if (e.httpStatus === 403) {
      // The user does not have the permission to update the connection. This
      // can happen if their permissions are limited to the role. In that case
      // we ignore the error and continue updating the role.
      return;
    }
    throw new Error(`Could not update allowed roles for selected database: ${e.errors.join(', ')}`);
  },
});

View on GitHub (pinned to 744b611b57)

Solutions

1. Open the browser network tab (or inspect e.errors) to see the underlying status and message from the failed /v1/<mount>/config/<connection> request
2. Verify the connection still exists and its plugin is healthy: vault read <mount>/config/<connection>
3. Fix the external database connectivity or plugin error reported in e.errors, then retry the role save
4. If the user intentionally has role-only permissions, make sure their policy produces a 403 on the connection path so the UI correctly skips the allowed_roles update

Example fix

// before: role.save() fails with generic wrapped error
try {
  await role.save();
} catch (e) {
  // 'Could not update allowed roles for selected database: ...'
}

// after: distinguish the connection-update failure from the role save
try {
  await role.save();
} catch (e) {
  if (e.message.startsWith('Could not update allowed roles')) {
    const detail = e.message.split(': ')[1];
    this.flash.danger(`Connection update failed (${detail}). Verify the connection exists and the plugin is healthy.`);
  } else {
    throw e;
  }
}

// Before saving a new/deleted role, confirm the connection is readable and savable
const connection = await this.store.queryRecord('database/connection', { backend, id: db });
if (!connection) {
  throw new Error(`Connection ${db} not found on ${backend}; fix it before managing roles.`);
}

try {
  await role.save();
} catch (e) {
  if (e.message.startsWith('Could not update allowed roles')) {
    // 403 on the connection update is intentionally ignored inside the adapter;
    // anything else means the allowed_roles sync genuinely failed — surface the detail
    const detail = e.message.split(': ')[1] ?? 'unknown';
    notifyUser(`Database connection update failed: ${detail}`);
  } else {
    throw e;
  }
}

When it happens

Trigger: Creating (createRecord) or deleting (deleteRecord) a dynamic or static role when the intermediate connection.save() (PUT/POST /v1/<mount>/config/<connection>) fails non-403: connection was deleted or renamed out-of-band (404), the database plugin rejects the payload (400), the external database is unreachable (500), or a network/adapter error where e.errors may even be undefined.

Common situations: Connection record removed in another tab or by another admin while the role form is open; the DB plugin cannot reach the external database so config writes fail; a policy that denies with 404 instead of 403; partially-granted ACLs that produce 400s on the connection update.

Related errors

• A record already exists with the name: ${name}

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/0bdb58f57eab9bf3. Report an issue: GitHub.