Configuring Automated Snapshots with AWS EC2 & Integrated Storage – HashiCorp Help Center

This is a brief article detailing the steps needed to set up Vault Auto-Snapshots to an AWS S3 Bucket when Raft / Integrated Storage is used.

Steps:

Create an AWS S3 bucket to store Vault snapshots.
Create a KMS key to encrypt the Bucket contents.

Create an IAM Role for the Vault instance to allow appropriate access and privileges to KMS and S3. A policy like that exemplified below will be needed for the IAM role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::mybucket1993till/*.snap"
    },
    {
      "Sid": "VisualEditor1",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucketVersions",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::mybucket1993till"
    },
    {
      "Sid": "VisualEditor2",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::mybucket1993till",
        "arn:aws:s3:::mybucket1993till/*"
      ]
    },
    {
      "Sid": "VisualEditor3",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    }
  ]
}

Deploy Vault on EC2 instances, initialize & unseal it; ensure that there's an active Vault leader.
Attach the IAM role to the EC2 instance.

Run the CLI configuration below addressed directly to the leader or on the EC2 instance itself:

AREGION=...  # // set AWS REGION - eg: 'us-east-2'
AKMS_ID=...  # // set AWS KMS ID - eg: 'mrk-b26872139b14462c8fb7927df4ea1209'
ABUCKET=...  # // set AWS Bucket - eg: 'mybucket1993till'
APREFIX=...  # // set AWS path_prefix eg: 'vault/backups'

# // Set the values of interval and retain as per your needs.
vault write sys/storage/raft/snapshot-auto/config/hourly interval=1h retain=96 storage_type=aws-s3 aws_s3_enable_kms=true path_prefix=${APREFIX} aws_s3_bucket=${ABUCKET} aws_s3_region=${AREGION} aws_s3_kms_key=${AKMS_ID}

Note: the parameter path_prefix is the AWS S3 Bucket directory to which snapshots should be saved/written. If not specified then snapshots will be saved to the root of the AWS Bucket itself. Set this value if a folder hierarchy is desired inside of the AWS Bucket.

Run the below command to see the stored/written auto-snapshot config on Vault:
```
vault read sys/storage/raft/snapshot-auto/config/hourly
```

The following log entry can be found post you write the snapshot-auto config to Vault.
```
[TRACE] core.snapshotmgr.hourly: starting snapshot runner: name=hourly
```

The following snippet shows the snapshots stored in S3:

Reference Articles:

Steps:

Reference Articles:

Articles in this section

Related articles