diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
index ca70c8b2..c38002fa 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
@@ -17,6 +17,9 @@ package org.springframework.vault.config;
 
 import java.net.URI;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 import org.springframework.beans.BeansException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.ApplicationContextAware;
@@ -132,7 +135,8 @@ import org.springframework.web.client.RestOperations;
  * <li>AWS EC2 path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to
  * {@link AwsEc2AuthenticationOptions#DEFAULT_AWS_AUTHENTICATION_PATH})</li>
  * <li>Role: {@code vault.aws-ec2.role} (since 2.2.1)</li>
- * <li>RoleId: {@code vault.aws-ec2.role-id} (@Deprecated - use {@code vault.aws-ec2.role} instead)</li>
+ * <li>RoleId: {@code vault.aws-ec2.role-id} (<strong>deprecated since 2.2.1:</strong> use
+ * {@code vault.aws-ec2.role} instead)</li>
  * <li>Identity Document URL: {@code vault.aws-ec2.identity-document} (defaults to
  * {@link AwsEc2AuthenticationOptions#DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI})</li>
  * </ul>
@@ -178,6 +182,9 @@ import org.springframework.web.client.RestOperations;
 public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration
 		implements ApplicationContextAware {
 
+	private static final Log logger = LogFactory
+			.getLog(EnvironmentVaultConfiguration.class);
+
 	private @Nullable RestOperations cachedRestOperations;
 	private @Nullable ApplicationContext applicationContext;
 
@@ -350,9 +357,16 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration
 		Assert.isTrue(StringUtils.hasText(roleId) || StringUtils.hasText(role),
 				"Vault AWS-EC2 authentication: Role (vault.aws-ec2.role) must not be empty");
 
-		Assert.isTrue(!(StringUtils.hasText(roleId) && StringUtils.hasText(role)),
-				"Vault AWS-EC2 authentication: Only one of Role (vault.aws-ec2.role) or"
-						+ " RoleId(@Deprecated) (vault.aws-ec2.roleId) must be provided");
+		if (StringUtils.hasText(roleId) && StringUtils.hasText(role)) {
+			throw new IllegalStateException(
+					"AWS-EC2 Authentication: Only one of Role (vault.aws-ec2.role) or"
+							+ " RoleId (deprecated, vault.aws-ec2.roleId) must be provided");
+		}
+
+		if (StringUtils.hasText(roleId)) {
+			logger.warn(
+					"AWS-EC2 Authentication: vault.aws-ec2.roleId is deprecated. Please use vault.aws-ec2.role instead.");
+		}
 
 		AwsEc2AuthenticationOptionsBuilder builder = AwsEc2AuthenticationOptions.builder()
 				.role(StringUtils.hasText(role) ? role : roleId).path(path);
@@ -361,20 +375,21 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration
 			builder.identityDocumentUri(URI.create(identityDocument));
 		}
 
-		return new AwsEc2Authentication(builder.build(), restOperations(), restOperations());
+		return new AwsEc2Authentication(builder.build(), restOperations(),
+				restOperations());
 	}
 
 	protected ClientAuthentication azureMsiAuthentication() {
 
-		String roleId = getProperty("vault.azure-msi.role");
+		String role = getProperty("vault.azure-msi.role");
 		String path = getProperty("vault.azure-msi.azure-path",
 				AzureMsiAuthenticationOptions.DEFAULT_AZURE_AUTHENTICATION_PATH);
 
-		Assert.hasText(roleId,
+		Assert.hasText(role,
 				"Vault Azure MSI authentication: Role (vault.azure-msi.role) must not be empty");
 
 		AzureMsiAuthenticationOptionsBuilder builder = AzureMsiAuthenticationOptions
-				.builder().role(roleId).path(path);
+				.builder().role(role).path(path);
 
 		return new AzureMsiAuthentication(builder.build(), restOperations());
 	}
diff --git a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java
index 083be9db..efd3edff 100644
--- a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java
+++ b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java
@@ -35,7 +35,7 @@ import static org.assertj.core.api.Assertions.assertThat;
  */
 @ExtendWith(SpringExtension.class)
 @TestPropertySource(properties = { "vault.uri=https://localhost:8123",
-		"vault.authentication=aws-ec2", "vault.aws-ec2.role-id=role" })
+		"vault.authentication=aws-ec2", "vault.aws-ec2.role=role" })
 class EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests {
 
 	@Configuration
diff --git a/src/main/asciidoc/reference/imperative-template.adoc b/src/main/asciidoc/reference/imperative-template.adoc
index 2f4e201e..eff1a8e3 100644
--- a/src/main/asciidoc/reference/imperative-template.adoc
+++ b/src/main/asciidoc/reference/imperative-template.adoc
@@ -199,7 +199,7 @@ Any other value is used with `StaticUserId`.
 
 * AWS EC2 path: `vault.aws-ec2.aws-ec2-path` (defaults to `aws-ec2`)
 * Role: `vault.aws-ec2.role`
-* RoleId: `vault.aws-ec2.role-id` (deprecated - use `vault.aws-ec2.role` instead)
+* RoleId: `vault.aws-ec2.role-id` (*deprecated:* use `vault.aws-ec2.role` instead)
 * Identity Document URL: `vault.aws-ec2.identity-document` (defaults to `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7`)
 
 **<<vault.authentication.azuremsi>>**