title: Vault fail to auto unseal after consul snapshot restore
body: <p>So basically, I have set up an architecture with Consul/Vault in a kubernetes cluster within AWS. My vault auto unseals with AWS KMS when the pods start.</p>
  
  <p>Recently I’ve done some testing around backing up vault using consul snapshot.</p>
  
  <p>The scenario I tested is:</p>
  
  <ol>
  <li>First taking snapshot of vault consul snapshot save vault.prod.snap</li>
  <li>Then removing vault doing consul kv delete -recurse vault/</li>
  <li>Removing vault statefulsets and pods</li>
  <li>consul snapshot restore vault.prod.snap</li>
  <li>Finally re-create vault statefulsets</li>
  </ol>
  
  <p>Result:</p>
  
  <p>I got an error 500 on the third key during the auto unseal that says:
  body {“errors”:[“failed to decrypt encrypted stored keys: cipher: message authentication failed”]}</p>
  
  <p>I tried that another test where I don’t clean the vault with command kv delete -recurse vault/
  I basically just remove a couple of policies in the UI and the restore. That scenario seems to work correctly, it’s only when I restore from “scratch”, that my vault cannot unseal anymore.</p>
  
  <p>could somebody give me some hint please ?</p>