Skip to main content
In this guide, we’ll demonstrate how to manually create and restore Raft snapshots in Vault’s Integrated Storage and configure automated backups with Vault Enterprise.

​
Prerequisites

  • Vault OSS or Enterprise (v1.10.2+ for scheduled snapshots)
  • Vault Enterprise license
  • CLI access to your Vault server

​
Manually Taking a Raft Snapshot

Use the vault operator raft snapshot save command to export the entire Vault state into a single file:
Verify the snapshot file in your working directory:
Each Raft snapshot includes Vault’s complete configuration, metadata, and KV data. Store snapshots in a secure, redundant location.

​
Restoring from a Snapshot

To restore a Vault node from an existing snapshot, run:
This command rehydrates the Vault node with the state stored in temp.snap.
Restoring from a snapshot overwrites your existing Vault data. Confirm you have a valid backup before proceeding.

​
Configuring Automated Snapshots (Enterprise Only)

Vault Enterprise supports scheduled Raft snapshots via the sys/storage/raft/snapshot-auto/config endpoint. First, confirm you’re running Enterprise:
Below is an example that schedules hourly local snapshots and retains the last 24 files:

​
Configuration Fields

List configured snapshot jobs:
Verify the local snapshot directory:

​
Using Cloud Storage for Automated Snapshots

To store snapshots in AWS S3, set storage_type=aws-s3 and specify your bucket:
Additional AWS options:
  • aws_s3_endpoint: Custom S3 endpoint (e.g., VPC endpoint)
  • aws_access_key_id / aws_secret_access_key: IAM credentials (if not using roles)
  • kms_key_id: KMS key for server-side encryption

​
Summary

You’ve learned how to:
  1. Create and restore one-off Raft snapshots with vault operator raft snapshot.
  2. Configure automated snapshot jobs in Vault Enterprise for both local storage and AWS S3.
Automated Raft snapshots ensure continuous, reliable backups of your Vault data with minimal manual effort.

Watch Video