Simple Vault config for consul backend and auto-unsealing using azure key vault

Consul-backend-azure-unseal.hcl

listener "tcp" {
    address         = "0.0.0.0:8200"
    tls_disable     = 1 # TLS will need to be enabled for production
    tls_min_version = "tls12"
}
storage "consul" {
    address         = "consul:8500"
    path            = "vault"
    service         = "vault"
    scheme          = "http"
}

seal "azurekeyvault" {
    # These values will need to be set as environment variables on the VM
    # as the VMs are hosted on azure we can also use an MSI by enabling this on the VM

    tenant_id     = ""
    client_id     = ""
    client_secret = ""

    # These values are fine to stay as parameters but can still be stored as environment variables
    vault_name    = ""
    key_name      = ""
}

ui = true

# service principle used for unsealing will need get & list key management operations permissions and also unwrap key and wrap key cryptographic operations permissions for the Azure key vault used to unseal the cluster instances