External Key Management

We use Hashicorp Vault as an external key management for our GCP instances. Plan is to implement this software to Heztner Cloud VM so we actually have key management outside of GCP too. We of course need some backup from KMS to somewhere, not decided yet.

Process diagram or some technical infra drawing maybe here?