GCP secret engine: time-out issues configuring roleset

Introduction :

When attempting to configure a roleset in the GCP Secret Engine of Vault, users may encounter a timeout error. This typically occurs when Vault tries to communicate with the Google Cloud Platform (GCP) to verify the service account, but is unable to complete the handshake, token generation process or the roleset creation operation. Below is how the error might look like :

Error configuring roleset: Error making API request.

URL: PUT https://vault.example.com/v1/gcp/roleset/my-roleset
Code: 500. Errors:

* context deadline exceeded

Root cause :

The error context deadline exceeded typically indicates that Vault could not reach the GCP API within the expected time frame. This could be due to:

• Network latency or firewall restrictions

• Incorrect or missing IAM permissions

• Misconfigured service account JSON credentials

• Vault’s GCP Secrets Engine backend unable to reach GCP endpoints

Possible solutions :

Validate Service Account Credentials

Ensure the service account JSON being used is valid and has the correct IAM roles.

Test GCP API Access

• If gcloud utility is available on vault server;  run below

curl -X GET \
https://iam.googleapis.com/v1/projects/YOUR_PROJECT_ID/serviceAccounts \
-H "Authorization: Bearer $(gcloud auth print-access-token)"

If this fails, the Vault instance may not have outbound internet access or the service account may lack required permissions.

• Connectivity checks can be performed with below commands:

curl -v https://iam.googleapis.com/v1/projects/your-project-name

nc -zv iam.googleapis.com 443

Increase Timeout

• Set appropriate Vault timeouts using the VAULT_CLIENT_TIMEOUT environment variable if applicable.
• Note that by default, google API methods are applied a default timeout of 60.0 seconds. If roleset creation is taking longer than 60 seconds, review contents of file being used for binding parameter . If there are multiple resources defined  in the binding, attempt creating roleset with less number of resources and see if that succeeds.