How to manage Hashicorp Vault patching in AWS? I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for patching, but won't that cause the patched instances to restart, and then the Vault instances will need to be unsealed every time?

One workaround for this would be using the AWS KMS driven unseal approach. Anyone have any experience with this?
The canon solution is to use KMS auto-unseal: https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms