How To Setup Vault on AWS EC2 Instance

Configure Vault on Amazon EC2 Instance

Hashicorp Vault is one of the best open source software to manage secrets. All secrets in the vault will be encrypted.

Hashicorp Vault Use Cases

Vault has many use cases when it comes to enterprise implementation. For small scale setup, the vault use cases normally come down to the following.

  1. Application Secrets management
  2. SSH keys management
  3. Data Encryption

Hashicorp Vault Setup on Amazon Ec2

In this tutorial, you will learn how to set up a Hashicorp vault server on an Amazon ec2 Linux server for secret management.


  1. A Linux ec2 instance.
  2. Access to the ec2 instance over ssh.
  3. In the Security group, port 8200 open to access vault UI, API, and SSH access.

Note: This tutorial is for single node vault setup with minimal configuration.

Step 1: Head over to vault downloads page, get the latest vault setup for Linux amd64.

Step 2: Download the vault binary to /opt location.

cd /opt/ && sudo curl -o

Step 3: Unzip the vault executable.

sudo unzip

Step 4: Move the vault executable to /usr/bin directory.

sudo mv vault /usr/bin/

Step 5: Create a user named vault to run as a service.

sudo useradd --system --home /etc/vault.d --shell /bin/false vault

Configure Vault as a System Service

Step 1: Create a vault systemd service file.

sudo vi /etc/systemd/system/vault.service

Step 2: Copy the below configuration to the service file.

Description="HashiCorp Vault Service"

CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID


Step 3: Create the vault configuration, data & logs directory. Also change the ownership of vault directory to vault user.

sudo mkdir /etc/vault.d
sudo chown -R vault:vault /etc/vault.d
sudo mkdir /vault-data
sudo chown -R vault:vault /vault-data
sudo mkdir -p /logs/vault/

Step 4: Create a vault.hcl file which holds all the vault configuration.

sudo vi /etc/vault.d/vault.hcl

Step 5: Copy the below configuration and save the file.

listener "tcp" {
  address     = ""
  tls_disable = 1

telemetry {
  statsite_address = ""
  disable_hostname = true

storage "file" {
  path = "/vault-data"

ui = true

Step 6: Enable, start and check the status of vault service.

sudo systemctl enable vault
sudo systemctl start vault
sudo systemctl status vault

Step 7: Access the vault UI using the public IP /Private IP on port 8200 as shown below.

When you access the vault UI, by default it will be sealed as shown below.


Step 8: Initialise vault using initialise button with 3 key shares.

image 1

Step 9: Download the keys using the “Download Keys” button and click “continue to unseal” button.

Note: The key files is very important and you should keep it safe. For any reason if you restart the server or vault service, vault get locked. You will need these keys to unlock it.

image 2

Step 10: Enter three keys one by one from the downloaded key file to unseal vault.

image 3

Step 11: Once unsealed, login to vault with the root_token from the downloaded key file.

image 4

Thats it! You will be logging in to vault server with all default settings.

image 5

Hope this article helps with your initial vault setup on AWS ec2. For production use cases, you should have HA, SSL and other configurations enabled. Connect with me at admin@comtechies to such use cases.

In the next article we will look in to the following

  1. Storing and Retrieving secrets from the Vault Server
  2. Backing up vault secret data
  3. Vault Best Practices for Storing and Retrieving Secrets
  1. Hi Bibin,
    Thanks for the article. I started the vault service on ec2 instance but Iam unable to launch web ui either from Public or Private ip.
    Please suggest what needs to be checked

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like