What is Vault's seal/unseal mechanism?
⚡
Quick Answer
Vault starts sealed with its data encrypted; unsealing reconstructs the master key (via Shamir shares or auto-unseal) to decrypt storage.
Detailed Answer
The root/master key that encrypts Vault's storage is itself protected. On start Vault is sealed and unusable until unsealed — either by providing a threshold of Shamir key shares held by different operators, or via auto-unseal backed by a cloud KMS/HSM. Sealing protects data at rest if the host is compromised.
💡
Interview Tip
Mention auto-unseal with a cloud KMS for production.
vaultsealunseal