# Vault Unseal With Custom KMS Key (BYOK)

**URL:** <https://discuss.hashicorp.com/t/vault-unseal-with-custom-kms-key-byok/74327>\
**Category:** Vault\
**Tags:** k8s, vault\
**Created:** [April 9, 2025, 10:17am UTC](https://discuss.hashicorp.com/t/vault-unseal-with-custom-kms-key-byok/74327 "2025-04-09T10:17:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nathanbam01](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/nathanbam01/32/44344_2.png) [@nathanbam01](https://discuss.hashicorp.com/u/nathanbam01)\
**Post date:** [April 9, 2025, 10:17am UTC](https://discuss.hashicorp.com/t/vault-unseal-with-custom-kms-key-byok/74327/1 "2025-04-09T10:17:47Z")

</div>

I’m creating a KMS key in AWS with my own key material and use that KMS key to configure Vault auto unseal. It works perfectly, but I am trying to simulate a scenario where I lose the KMS key and need to create a new one with the same key material.  
My expectation was that the new key could still unseal Vault as the key material is the same, but Vault still seems to reference the old key ARN somehow (after updating the config to point to the new key ARN).

Using Vault 1.18.1 running in EKS

Is there a way to unseal Vault with the new KMS key that contains the same key material?

---

<div class="post-metadata">

**Author:** ![jonathanfrappier](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jonathanfrappier/32/28004_2.png) [@jonathanfrappier](https://discuss.hashicorp.com/u/jonathanfrappier)\
**Post date:** [April 10, 2025, 1:46pm UTC](https://discuss.hashicorp.com/t/vault-unseal-with-custom-kms-key-byok/74327/2 "2025-04-10T13:46:41Z")

</div>

When you create a new key (even with the same material), the key is still different than the original key you created. The key material protects the key, it is not the key itself, nor does it recreate an identical key.

The AWS auto-unseal mechanism does support AWS rotation, so you can configure the KMS to create new keys (though not your specific scenario):

> **[Rotate AWS KMS keys - AWS Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)**
>
> Learn about automatic, on-demand, and manual rotation of your AWS KMS keys.

In your scenario where you are planning for the key to be totally lost, I would look into seal HA where you can configure multiple unseal mechanisms so if one is lost, you can still access Vault:

> **[Configure HA for Vault seals | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/configuration/seal/seal-ha)**
>
> Customize the seal stanza to support multiple seals in high availability deployments.

---

<div class="post-metadata">

**Author:** ![nathanbam01](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/nathanbam01/32/44344_2.png) [@nathanbam01](https://discuss.hashicorp.com/u/nathanbam01)\
**Post date:** [April 11, 2025, 10:23am UTC](https://discuss.hashicorp.com/t/vault-unseal-with-custom-kms-key-byok/74327/3 "2025-04-11T10:23:48Z")

</div>

This was helpful - we were trying to figure out if the plan we had was possible. Thanks a ton for sharing your knowledge!