Skip to main content
In this tutorial, you’ll manually deploy a three-node Vault cluster on AWS EC2 using the Raft storage backend and AWS KMS auto-unseal. This configuration provides strong consistency, high-availability failover, and seamless unsealing.

​
Cluster Topology

We have three EC2 instances running Vault v1.10.3+ent: Each instance is configured with:
  • storage "raft" (Vault Raft storage backend)
  • seal "awskms" (AWS KMS auto-unseal)

​
1. Verify Vault Status on All Nodes

On each node, confirm Vault is running but neither initialized nor unsealed:
Expected output: Key Value
Recovery Seal Type awskms
Initialized false
Sealed true
Version 1.10.3+ent
Storage Type raft
HA Enabled true

​
2. Initialize the Leader (vault-3)

SSH into vault-3 and run:
Save the recovery keys and the Initial Root Token securely.
Now you should see Initialized true but Sealed true. AWS KMS will auto-unseal followers when they join.
Store your recovery keys and root token in a secure vault or vaultless backup. Losing them can lock you out of your cluster.
Ensure the IAM role attached to each EC2 instance has permissions to decrypt with your AWS KMS key, or auto-unseal will fail.

​
3. List Raft Peers on vault-3

Authenticate with the root token and list peers:
Initially, only vault-3 appears as the leader.

​
4. Join vault-1 to the Cluster

On vault-1:
Back on vault-3, watch vault-1 join and become a voter:
Repeat until vault-1’s Voter column is true. Then on vault-1:
You should see:
  • Initialized true
  • Sealed false
  • Performance Standby Node true

​
5. Add vault-2 to the Raft Cluster

On vault-2:
Confirm all three peers are present and voters on any node:

​
6. Test Leader Failover

  1. Stop Vault on the current leader (vault-3):
  2. On vault-1 or vault-2, confirm a new leader election:
  3. Restart vault-3:
vault-3 rejoins as a follower and does not reclaim leadership automatically.

​
7. Manual Step-Down

Force the current leader to step down manually (on vault-1, for example):
Confirm the new leader:

​
Summary

  • Initialized vault-3 and formed a single-node cluster.
  • Joined vault-1 and vault-2 with vault operator raft join.
  • Verified AWS KMS auto-unseal on followers.
  • Simulated automatic leader election by stopping the leader.
  • Demonstrated manual failover using vault operator step-down.
Next, we’ll automate cluster formation with the [Raft retry-join configuration] and EC2 tags for dynamic membership.

Watch Video