You are mistaken: "Even will a ttl set, the secrets engine never removes data on its own. The ttl key is merely advisory." - https://www.vaultproject.io/docs/secrets/kv/index.html