Spring + Vault Secret Engine Database Connection - spring

Question

I've stumbled across a problem with Spring and Vault Secret Engine. I do have a set database connection, for which the lease can be generated succesfully via vault cli (vault read database/creds/my-role)
Now, I do have a spring service deployed via Terraform and a vault policy document:
data "vault_policy_document" "this" {
rule {
path = "/database/creds/my-role"
capabilities = ["read"]
description = "Allow service to write and read into/from it's vault database path"
}
}
The service logs:
{"type":"application","service":"identcheck-service","timestamp":"2022-02-17 11:54:29,822","level":"WARN","message":"[RequestedSecret [path='database/creds/my-role', mode=RENEW]] Lease │
│ [leaseId='database/creds/my-role/ej2iuCzhcO8gToGjX3mFeOgg', leaseDuration=PT5M, renewable=true] Status 403 Forbidden: 1 error occurred:\n\t* permission denied\n\n; nested exception is o │
│ rg.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: \"{\"errors\":[\"1 error occurred:\\n\\t* permission denied\\n\\n\"]}<EOL>\"","thread":"main","process_id":"8","logger":"org.s │
│ pringframework.vault.core.lease.SecretLeaseEventPublisher$LoggingErrorListener","class":"org.springframework.boot.logging.DeferredLog","method":"logTo"}
If, however, I change the path to "*" and grant all capabilities it works just fine.I'd really like to reduce the capabilities for the service to the specific db path.
Any ideas what could cause this?
Thanks in advance