# Auto-Unseal to Shamir, as Vault destroyed **URL:** \ **Category:** Vault\ **Tags:** vault\ **Created:** [May 5, 2022, 4:25pm UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136 "2022-05-05T16:25:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![s01u5](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/s01u5/32/27671_2.png) [@s01u5](https://discuss.hashicorp.com/u/s01u5)\ **Post date:** [May 5, 2022, 4:25pm UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136/1 "2022-05-05T16:25:06Z")
Hi All, I have two vault instances, Vault-1 and Vault-2. `Vault-1`, which is main vault, get auto-unsealed by Vault-2 using `transit secret engine`. But, unfortunately, I have completed destroyed the Vault-2, which is unsealing the Vault-1. Now, the main vault is get stuck. I have setup a new vault instance and configure to use transit engine. While, migrating from transit to shamir with new Vault, the migration part stuck at `third recovery key`. `Is it because the current recovery keys are related to the deleted vault instance? Anyway to recover my vault instance now?` If the unsealing vault gets destroyed or down for some reason, how should we migrate the unsealing process, if there’s no way to bring it up? ![image](https://global.discourse-cdn.com/hashicorp/original/3X/b/0/b0e8a9b636f97b2903e3e9ba22ba4c8894e30b65.png) ![image](https://global.discourse-cdn.com/hashicorp/original/3X/c/1/c19bcd090047525ec4489e497907d0de09951316.png) ---
**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\ **Post date:** [May 5, 2022, 5:25pm UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136/2 "2022-05-05T17:25:22Z")
Unfortunately, your Vault is lost. From [Seal/Unseal | Vault | HashiCorp Developer](https://www.vaultproject.io/docs/concepts/seal#auto-unseal:) > **Note:** Recovery keys cannot decrypt the root key, and thus are not sufficient to unseal Vault if the AutoUnseal mechanism isn’t working. They are purely an authorization mechanism. Personally I was very surprised to read that, and think “recovery keys” is an awful name for them, considering that. I’ve been contemplating filing a GitHub issue about that, but have not yet got around to doing so. ---
**Author:** ![s01u5](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/s01u5/32/27671_2.png) [@s01u5](https://discuss.hashicorp.com/u/s01u5)\ **Post date:** [May 6, 2022, 5:47am UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136/3 "2022-05-06T05:47:05Z")
Ohh, then I messed up, as it seems. Thank you for the response, @maxb . Then, even if we have snapshot of main vault ,in my case `Vault-1`, we can’t migrate as I understood. Can you please clarify with this? In my prod environment, the same setup is there. One is autosealing the other. SO, if something happens with unsealing Vault, snapshots aren’t going to help, right? ---
**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\ **Post date:** [May 6, 2022, 6:21am UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136/4 "2022-05-06T06:21:09Z")
Indeed, data inside a snapshot, is still encrypted using the key that was lost with vault-2. ---
**Author:** ![s01u5](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/s01u5/32/27671_2.png) [@s01u5](https://discuss.hashicorp.com/u/s01u5)\ **Post date:** [May 6, 2022, 6:30am UTC](https://discuss.hashicorp.com/t/auto-unseal-to-shamir-as-vault-destroyed/39136/5 "2022-05-06T06:30:55Z")
Thank you for the response @maxb . 🙂