<p>The canon solution is to use KMS auto-unseal: <a href="https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms" rel="nofollow noreferrer">https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms</a></p>

CC BY-SA 4.0
2019-08-28T15:13:25.237Z
2019-08-28T15:13:25.237Z
Prime
<p>I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?</p>

<p>One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?</p>

CC BY-SA 4.0
2019-08-05T07:35:37.253Z
Hi there! This sounds like an interesting problem, but it's not clear to me what the main question is. It sounds like you want to not have to unseal the vault - but under what conditions? Would it be acceptable for you to have a notification that the service has been restarted and an unseal is necessary? Or is any kind of downtime unacceptable? Can you provide some constraint to the question please?
Bruce Becker
CC BY-SA 4.0
2019-08-05T21:38:35.173Z
I'd like to avoid downtime, if possible. This seems like it would be a common problem for other Vault users, so I wanted to see if there was a simple solution that I was overlooking.
Prime
<amazon-web-services><amazon-ec2><hashicorp-vault><secret-management>
How to manage Hashicorp Vault patching in AWS?
Prime
# How to manage Hashicorp Vault patching in AWS?

(Asked by: username_0 on 2019-08-01)

I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?

One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?

**Tags:** amazon-web-services, amazon-ec2, hashicorp-vault, secret-management

> **Comments:**
> **username_1**: Hi there! This sounds like an interesting problem, but it's not clear to me what the main question is. It sounds like you want to not have to unseal the vault - but under what conditions? Would it be acceptable for you to have a notification that the service has been restarted and an unseal is necessary? Or is any kind of downtime unacceptable? Can you provide some constraint to the question please?  
> **username_0**: I'd like to avoid downtime, if possible. This seems like it would be a common problem for other Vault users, so I wanted to see if there was a simple solution that I was overlooking.  

---

## 1 answers

### Answer by username_0 on 2019-08-28. Score: 0 | Accepted answer

The canon solution is to use KMS auto-unseal: <https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms>


---

