Answers: <p>The canon solution is to use KMS auto-unseal: <a href="https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms" rel="nofollow noreferrer">https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-28T15:13:25.237Z
Answers: 2019-08-28T15:13:25.237Z
Answers: Prime
Body: <p>I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?</p>
  
  <p>One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-08-05T07:35:37.253Z
Comments: Hi there! This sounds like an interesting problem, but it's not clear to me what the main question is. It sounds like you want to not have to unseal the vault - but under what conditions? Would it be acceptable for you to have a notification that the service has been restarted and an unseal is necessary? Or is any kind of downtime unacceptable? Can you provide some constraint to the question please?
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2019-08-05T21:38:35.173Z
Comments: I'd like to avoid downtime, if possible. This seems like it would be a common problem for other Vault users, so I wanted to see if there was a simple solution that I was overlooking.
Comments: Prime
Tags: <amazon-web-services><amazon-ec2><hashicorp-vault><secret-management>
Title: How to manage Hashicorp Vault patching in AWS?
UserDisplayName: Prime
ThreadText: # How to manage Hashicorp Vault patching in AWS?
  
  (Asked by: username_0 on 2019-08-01)
  
  I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?
  
  One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?
  
  **Tags:** amazon-web-services, amazon-ec2, hashicorp-vault, secret-management
  
  > **Comments:**
  > **username_1**: Hi there! This sounds like an interesting problem, but it's not clear to me what the main question is. It sounds like you want to not have to unseal the vault - but under what conditions? Would it be acceptable for you to have a notification that the service has been restarted and an unseal is necessary? Or is any kind of downtime unacceptable? Can you provide some constraint to the question please?  
  > **username_0**: I'd like to avoid downtime, if possible. This seems like it would be a common problem for other Vault users, so I wanted to see if there was a simple solution that I was overlooking.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-08-28. Score: 0 | Accepted answer
  
  The canon solution is to use KMS auto-unseal: <https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms>
  
  
  ---
  
  