1

I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?

One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?

Improve this question
2
  • Hi there! This sounds like an interesting problem, but it's not clear to me what the main question is. It sounds like you want to not have to unseal the vault - but under what conditions? Would it be acceptable for you to have a notification that the service has been restarted and an unseal is necessary? Or is any kind of downtime unacceptable? Can you provide some constraint to the question please?
    – Bruce Becker
    Commented Aug 5, 2019 at 7:35
  • I'd like to avoid downtime, if possible. This seems like it would be a common problem for other Vault users, so I wanted to see if there was a simple solution that I was overlooking.
    – Prime
    Commented Aug 5, 2019 at 21:38

1 Answer 1

Reset to default
0

The canon solution is to use KMS auto-unseal: https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.