Designing High Availability for HashiCorp Vault in AWS
summary
Shows how to run Vault HA on AWS using Consul or DynamoDB storage, with concrete configs (DynamoDB example and Consul client on :8500), recommends AWS KMS auto-unseal (moved into open source v1.0) to avoid manual unseal, and requires at least two audit backends to avoid request blocking. Deploy cluster across AZs with spread placement groups, self-referencing security groups, and ALB health checks hitting _/v1/sys/health_ for 200. Backup Consul snapshots to S3 and replicate via enterprise performance vs DR replication with cross-region connectivity and manual failover.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:57Storage backends
- 3:54Local redundancy
- 5:09Security
- 8:26Auto Devices
- 9:32Deployment
- 14:32Vault Disaster Recovery
- 25:30Conclusion
related talks
23mHashiCorp Vault and Getting Day 2 Operations Right
28mSecret Management with Hashicorp´s Vault
25mLessons learned from deploying Vault at scale
27mVault At Scale
44mSecret Management with Hashicorp's Vault
22mSecuring AWS Accounts With HashiCorp Vault
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
49mUsing HashiCorp Vault with Kubernetes