The name of the Vault PKI role used to issue certificates. Allowed characters are letters, digits, -, _ and ..

The role defines allowed domains, key type (RSA/EC), maximum TTL, and other constraints. Create the role in Vault before using this credential:

vault write <mount>/roles/<role> \
  allowed_domains="example.com" \
  allow_subdomains=true \
  max_ttl="24h" \
  key_type="rsa" \
  key_bits=2048

See the Vault PKI secrets engine documentation for full role configuration options.