Vault backend storage migration from s3 to dynamodb - amazon-s3

Question

I am trying to migrate vault storage from s3 bucket to dynamodb . The new vault ha cluster is in kubernetes
vault-2 1/1 Running 0 10s
vault-1 1/1 Running 0 15s
vault-0 1/1 Running 0 15s
I have used the below command to migrate the vault storage backend
vault operator migrate -config ~/Desktop/migrate.hcl
MacBook-Pro vaultconfig % cat ~/Desktop/migrate.hcl
storage_source “s3” {
bucket = “db-vault-cluster”
}
storage_destination “dynamodb” {
region = “us-east-1”
access_key = “***"
secret_key = "”
table = “demandbase-vault”
}
migration completed successfully, but was not able to view the secrets. When I restarted the pods, vault is not coming up again. and getting the below error.
2022-02-05T11:46:56.787Z [INFO] core: loaded wrapping token key
2022-02-05T11:46:56.803Z [INFO] core: successfully setup plugin catalog: plugin-directory=""""
2022-02-05T11:46:56.821Z [INFO] core: successfully mounted backend: type=system path=sys/
2022-02-05T11:46:56.822Z [INFO] core: successfully mounted backend: type=identity path=identity/
2022-02-05T11:46:56.822Z [INFO] core: successfully mounted backend: type=cubbyhole path=cubbyhole/
2022-02-05T11:46:58.753Z [INFO] core: pre-seal teardown starting
2022-02-05T11:46:58.753Z [INFO] core: pre-seal teardown complete
2022-02-05T11:46:58.753Z [ERROR] core: post-unseal setup failed: error=“error fetching default policy from store: failed to read policy: decryption failed: cipher: message authentication failed”
can someone help me to migrate the storage backend ?

Answer 1

Are you using the same seal stanza in your configuration? It looks like Vault finds the storage but can't decrypt it.
Copy the seal part of the original (S3) configuration to the new (DynamoDB) configuration.