Hashicorp Vault Config - AWS

vault-server-aws.hcl

ui = true

#mlock = true
disable_mlock = true

storage "raft" {
  path = "/opt/vault/data"

  retry_join {
    auto_join = "provider=aws region=ap-southeast-2 tag_key=App tag_value=vault"
    leader_tls_servername = "${SERVERNAME}"
    leader_ca_cert_file = "/opt/vault/tls/ca.cert"
  }
}

cluster_addr = "https://{{GetPrivateIP}}:8201"
api_addr = "https://${SERVERNAME}:8200"

# HTTPS listener
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/tls.crt"
  tls_key_file  = "/opt/vault/tls/tls.key"
  tls_disable_client_certs = "true"
}

# AWS KMS auto unseal
seal "awskms" {
 region = "ap-southeast-2"
 kms_key_id = "${KMS_ARN}"
}