recover

Appropriate Vault Enterprise license required

The recover command pulls data at the specified path from a loaded snapshot and restores it to the cluster, overwriting newer data on the same path.

Note

A path cannot be read, listed, or recovered from a snapshot if the path's mount has been disabled! Even if you later re-enable the same plugin at the same path, the underlying identifiers for the plugin will be different and Vault will not be able to find the underlying storage entries for the mount within the snapshot.

Examples

Recover the KV version 1 secret at the path my-secret from the loaded snapshot with ID 2403d301-94f2-46a1-a39d-02be83e2831a:

$ vault recover -snapshot-id=2403d301-94f2-46a1-a39d-02be83e2831a secret/my-secret

Recover the KV version 1 secret at the path my-old/secret from the loaded snapshot with ID 2403d301-94f2-46a1-a39d-02be83e2831a, writing the data to the path my-new-secret:

$ vault recover -snapshot-id=2403d301-94f2-46a1-a39d-02be83e2831a -from=secret/my-old-secret secret/my-new-secret

Usage

The following flag is available in addition to the standard set of flags included on all commands.

Command options

snapshot-id (string: "") - Specifies a loaded snapshot ID to recover the data from.
from (string: "") - The source path to recover from