What is the Vault seal/unseal process and why is it necessary?

The seal/unseal process is Vault's security mechanism to protect the encryption key that encrypts all secrets stored in Vault.

Sealed State:

• Vault knows where data is stored but can't decrypt it
• All API operations except status checks are disabled
• Master key is encrypted and stored separately

Unsealing Process:

1. Vault starts in sealed state
2. Multiple unseal keys (threshold-based) are provided
3. Once threshold is met, master key is reconstructed
4. Vault can now decrypt and serve secrets

Why It's Necessary:

• Cold start protection: Prevents automatic access after restart
• Compromise mitigation: Stolen storage doesn't expose secrets
• Operational control: Requires deliberate action to make Vault operational

Auto-unseal options use external services (AWS KMS, Azure Key Vault) to automatically unseal Vault without manual intervention.