Switching to different aws kms key id (with the same key material)

Vault
21

I’m not an AWS KMS guru, but I’m sure it does not (have their own solution for that).

22

The problem is also discussed here:

We need to plan for a scenario where someone accidentally deletes a KMS key, or KMS itself is inaccessible in a region.

Another option considered was to import custom key material into a new KMS key. Because the old encrypted data references the original KMS key id, this doesn’t work when that key no longer exists.

As I understand, the key ID is randomly generated.

2 Likes
23

If I understand your discussion above well, it’s not possible to use shamir unseal keys to unseal Vault which go to seal state after accidentally deleting AWS kms key (which is used for auto-unseal) - or facing any other issue with kms key that results Vault to go to seal state?

24

@tmiroslav,

The discussion and original question was about recreating new aws kms cmk using the same key material.

25

Yes, what I understood, Vault can not handle situation where you change KMS ID used for Vault auto-unseal. But, at least per Vault documentation, Vault can handle AWS key rotation. So, KMS ID is same, but AWS change the key content in the back.
Good to know would be if unsealed keys retrieved during Vault initializations are enough to get Vault back to unseal state after trouble with.

26

Those are recovery keys and those cannot be used for unsealing.

1 Like
27

Don’t multi-region KMS keys address this? Multi-Region keys in AWS KMS - AWS Key Management Service

28

I’ve solved this in a backwards fashion. Note this requires a highly secured automation platform (GitlabCI, Jenkins, TeamCity, etc)

  1. take a nightly backup of the vault
  2. restore it to a new vault server that has access to the same KMS key
  3. Perform a seal migration, converting it to a Shamir seal, and store those keys safely
  4. Take a second backup of the Samir seal vault, and store that one away

So our DR is:
If the main instance goes down, but the key is still available, restore the backup from step 1. If it’s all burned down, grab the Shamir seal backup, unseal manually, and either (A) migrate data to a new vault server or (B) re-migrate it back to a new KMS key. We already had a secured enclave in our infra for this, so it worked for us. But yes, this is really, really not ideal.