Auto Unseal uses a cloud or on-premises HSM to decrypt the Master key

• Vault configuration file identifies the particular key to use for decryption

• Cloud Auto Unseal automatically unseals Vault upon service or node restart

without additional intervention

• Available in both open source and Enterprise editions

• Formally an Enterprise-only feature until Vault 1.0

storage "consul" {

address = "127.0.0.1:8500"

path = "vault/"

}

listener "tcp" {

address = "0.0.0.0:8200"

cluster_address = "0.0.0.0:8201"

}

seal "awskms" {

region = "REGION"

kms_key_id = "KMSKEY"

}

api_addr = "https://IPADDRESS:8200"

ui = true

seal “awskms” – identifies the type of seal mechanism for the cluster

region = “REGION” – identifies the region where the KMS key resides

kms_key_id = “KMSKEY” – identifies the actual KMS key in AWS