Share transit keys between clusters | Vault

Share transit keys between mounts and clusters. This is useful for scenarios where you want to use the same encryption keys across different Vault clusters or mounts.

Before you begin, ensure that marking a key as exportable is acceptable for your security posture. You can export keys marked as exportable and use them outside of Vault, which may not be suitable for all use cases. Modern security frameworks such as NIST, HIPAA, GDPR, and PCI require robust auditing, monitoring, and documentation requirements for any key export operations. Consult with your legal and security teams to ensure that exporting keys is acceptable for your organization.

Assumptions

Your authentication token has permissions to read keys from the source transit secrets engine and permissions to write keys to the destination transit secret engine.
You have audit logging enabled on both the source and destination clusters to track key export and import operations and alerts set up to notify you of import/export activity.

Enable the source and destination transit secrets engine if they are not already enabled.
Example source:
```
$ vault secrets enable -path transit-src transit
```
Example destination:
```
$ vault secrets enable -path transit-dest transit
```
Create a key in the source transit secrets engine.
```
$ vault write transit-src/keys/shared-key type=rsa-2048 exportable=true
```
You must set the exportable option to true to export the key. You cannot change the exportable option after you create the key.
Pull the destination mount's RSA wrapping public key.
```
$ WRAPPER_KEY=$(vault read -field=public_key transit-dest/wrapping_key)
```
This key exists so you can encrypt key material when exporting it from Vault.
Register the destination's wrapping public key as a key object inside transit-src.
```
$ vault write transit-src/keys/dest-wrapping-key/import type="rsa-4096" public_key="${WRAPPER_KEY}"
```
You use this key with the BYOK export endpoint, to encrypt and export payload for the destination mount.
Export version 1 of the shared-key.
```
$ IMPORT_PAYLOAD=$(vault read \
  -format=json \
  transit-src/byok-export/dest-wrapping-key/shared-key/1 \
  | jq '{type: .data.type, ciphertext: .data.keys["1"] }')
```
Vault encrypts the key in-place inside transit-src using dest-wrapping-key as the target. Only the transit-dest private key can decrypt the resulting ciphertext. The jq utility reshapes the response into {type, ciphertext}, the shape the import endpoint expects.
Import the key into the destination mount.
```
$ echo "${IMPORT_PAYLOAD}" | vault write transit-dest/keys/shared-key/import -
```
The transit-dest mount decrypts the payload internally using its private wrapping key and materializes it as shared-key. Plaintext key material never appears outside Vault at any point in this flow.