MIGRATE A VAULT

Prerequisites

If the target vault type is a non-local extension type (e.g. @swamp/aws-sm), authenticate with swamp auth login or set SWAMP_API_KEY with vault:* scope. Migrating between local_encryption vaults requires no Swamp authentication.

Preview the Migration

Use --dry-run to see what will be migrated without making changes.

swamp vault migrate my-secrets --to-type @swamp/aws-sm \
    --config '{"region": "us-east-1"}' --dry-run

INF vault·migrate Vault "my-secrets" ("local_encryption") has 2 secret(s).
INF vault·migrate Target: "AWS Secrets Manager" ("@swamp/aws-sm")
INF vault·migrate Dry run — no changes made.

Run the Migration

Remove --dry-run to execute.

swamp vault migrate my-secrets --to-type @swamp/aws-sm \
    --config '{"region": "us-east-1"}'

Secrets are copied to the target backend before the vault configuration is updated. If the copy fails mid-migration, the source vault is unchanged.

Verify

List the keys in the migrated vault and confirm a secret resolves.

swamp vault list-keys my-secrets
swamp vault read-secret my-secrets api-key --yes

Annotations are preserved during migration if both the source and target providers support them.

Migrate a vault on a remote server

To migrate a vault on a swamp serve instance, add --server:

swamp vault migrate my-secrets --to-type @swamp/aws-sm \
    --config '{"region": "us-east-1"}' --yes \
    --server wss://swamp.example.com

--to-type is required with --server; --dry-run is not available.

See the Vaults reference for the full set of migrate options.