HashiCorp Vault seal backend status operations.

This module provides seal backend health monitoring capabilities for Vault, allowing you to check the status and health of each backing seal mechanism. This is particularly useful for auto-seal configurations with multiple backends.

Seal Backend Status Features

Core Information

• Overall Health: Global health status of all seal backends
• Individual Backend Status: Health of each configured seal backend
• Unhealthy Tracking: Timestamp tracking for unhealthy backends
• Backend Names: Identification of each seal backend

Health Monitoring

• Real-time Status: Current health state of seal backends
• Failure Detection: Identification of unhealthy backends
• Timestamp Tracking: When backends became unhealthy
• Comprehensive Coverage: Status for all configured backends

Use Cases

• Infrastructure Monitoring: Track seal backend health
• Alerting Systems: Detect seal backend failures
• Operational Visibility: Understand seal configuration status
• Troubleshooting: Identify problematic seal backends

Important Notes

Unauthenticated Endpoint

• No authentication required to check backend status
• Safe to call from monitoring and health check systems
• Provides operational visibility without exposing secrets

Auto-Seal Configurations

• Most relevant for auto-seal setups (HSM, Cloud KMS, etc.)
• May show limited information for Shamir seal configurations
• Backend health affects Vault's ability to unseal automatically

High Availability Considerations

• Backend status may vary across cluster nodes
• Use for comprehensive cluster health monitoring
• Consider backend redundancy in HA configurations

API Compliance

Fully implements HashiCorp Vault Seal Backend Status API:

• Seal Backend Status API
• Auto-Seal Documentation

Usage Examples

Basic Backend Status Check

{:ok, status} = Vaultx.Sys.SealBackendStatus.get()

if status.healthy do
  IO.puts("All seal backends are healthy")
else
  IO.puts("Some backends are unhealthy since: #{status.unhealthy_since}")

  Enum.each(status.backends, fn backend ->
    if not backend.healthy do
      IO.puts("Backend #{backend.name} is unhealthy")
    end
  end)
end

Monitoring Integration

case Vaultx.Sys.SealBackendStatus.get() do
  {:ok, status} ->
    if not status.healthy do
      unhealthy_backends = Enum.filter(status.backends, & not &1.healthy)
      send_alert("Unhealthy seal backends: #{inspect(unhealthy_backends)}")
    end
  {:error, _} ->
    send_alert("Cannot check seal backend status")
end

Individual Backend Check

{:ok, backend_status} = Vaultx.Sys.SealBackendStatus.get_backend_status("hsm")

if backend_status.healthy do
  IO.puts("HSM backend is healthy")
else
  IO.puts("HSM backend unhealthy since: #{backend_status.unhealthy_since}")
end

Status Information

The seal backend status response includes:

Overall Status

• healthy: Boolean indicating if all backends are healthy
• unhealthy_since: Timestamp when any backend became unhealthy (if applicable)
• backends: List of individual backend status information

Individual Backend Status

• name: Name/identifier of the seal backend
• healthy: Boolean indicating if this backend is healthy
• unhealthy_since: Timestamp when this backend became unhealthy (if applicable)

Common Backend Types

Cloud KMS Backends

• AWS KMS: Amazon Key Management Service
• Azure Key Vault: Microsoft Azure Key Vault
• GCP Cloud KMS: Google Cloud Key Management Service

Hardware Security Modules

• PKCS#11: Hardware security module integration
• HSM: Various HSM implementations

Transit Backends

• Vault Transit: Another Vault instance as seal backend
• External Transit: External transit encryption services