Reversibility of the managed Secret Manager

The managed Secret Manager service is designed to guarantee reversibility, that is, the ability for the customer to retrieve their data and migrate to another solution without lock-in.

Exportable data

All the secrets, configurations and policies stored in a Secret Manager instance can be exported via the API of the OpenBao instance (compatible with HashiCorp Vault).

Reversibility tools

Raft snapshots via the HTTP API

OpenBao's Raft storage allows you to create complete snapshots of the instance, including all secrets, access policies and the configuration of the authentication methods.

Use the GET /v1/sys/storage/raft/snapshot endpoint:

curl \
  --header "X-Vault-Token: <token>" \
  --output snapshot.snap \
  https://<instance-host>/v1/sys/storage/raft/snapshot

For more details, refer to the Backups and restores guide.

Exporting secrets via the OpenBao API

The REST API of the instance allows you to export the data of each secrets engine:

curl --header "X-Vault-Token: <token>" \
     https://<instance-host>/v1/secret/metadata?list=true

Then, for each secret:

curl --header "X-Vault-Token: <token>" \
     https://<instance-host>/v1/secret/data/<secret-path>

Open formats

• Raft snapshots are in the standard OpenBao binary format, importable into any compatible OpenBao or Vault instance.
• The REST API uses the JSON format, an industry standard.
• Secrets in KV v2 format can be exported as JSON via the API.

Exit procedure

1. Create a complete Raft snapshot of the instance via the HTTP API (GET /v1/sys/storage/raft/snapshot).
2. Export the secrets individually via the REST API if a JSON format is required.
3. Deploy an OpenBao or Vault instance on the new platform.
4. Restore the Raft snapshot on the new instance via the HTTP API (POST /v1/sys/storage/raft/snapshot) or import the secrets via the API.
5. Check the integrity of the restored secrets and update the references in your applications.