vault_kv2_write - permission denied when updating an existing secret

[SBatais]

Hello

I'm using vault_kv2_write and it's working fine when the secret is not yet created, but it seems that it's not able to do an update of an existing secret when the value change. I get the error 'Permission denied'.

Do I need to set specific permissions ?
Do I need to set specific parameters in vault_kv2_write ?

Thanks in advance for your replies

My ansible code is:

- name: Write secret in HashiCorp Vault KV v2
  community.hashi_vault.vault_kv2_write:
    engine_mount_point: "{{ vault_engine_mount_point }}"
    path: "{{ vault_base_path }}/my-secret"
    auth_method: token
    token: "{{ vault_token }}"
    ca_cert: "{{ ca_cert_path }}"
    url: "{{ vault_url }}"
    read_before_write: true  # Read the secret first and write only when data differs from the read data.
    data:
      shared_secret: "{{ lookup('ansible.builtin.password', '/dev/null', chars=['ascii_letters', 'digits'], length=24) }}"

Traces:

The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_community.hashi_vault.vault_kv2_write_payload_jehvrd86/ansible_community.hashi_vault.vault_kv2_write_payload.zip/ansible_collections/community/hashi_vault/plugins/modules/vault_kv2_write.py", line 251, in run_module
  File "/usr/local/lib/python3.10/dist-packages/hvac/api/secrets_engines/kv_v2.py", line 205, in create_or_update_secret
    return self._adapter.post(
  File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 159, in post
    return self.request("post", url, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 408, in request
    response = super().request(*args, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 376, in request
    self._raise_for_error(method, url, response)
  File "/usr/local/lib/python3.10/dist-packages/hvac/adapters.py", line 294, in _raise_for_error
    utils.raise_for_error(
  File "/usr/local/lib/python3.10/dist-packages/hvac/utils.py", line 41, in raise_for_error
    raise exceptions.VaultError.from_status(
hvac.exceptions.Forbidden: 1 error occurred:
        * permission denied

[SBatais]

I close this discussion
It has been fixed by adding the permission UPDATE to the vault_token